CVE-2023-3676 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

🗓️ 31 Oct 2023 20:22:53Reported by kubernetesType

Insufficient input sanitization in Kubernetes leads to Windows node privilege escalatio

Reporter	Title	Published	Views	Family All 65
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	18 Aug 202504:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable due to k8s.io/kubernetes ( CVE-2023-2728, CVE-2023-2727, CVE-2023-5408, CVE-2023-3955, CVE-2023-3676 )	8 Aug 202415:28	–	ibm
BDU FSTEC	The vulnerability of the module related to the software for managing clusters of virtual machines in Kubernetes allows a hacker to increase their privileges.	29 Aug 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the module related to the software for managing clusters of virtual machines in Kubernetes allows a hacker to increase their privileges.	29 Aug 202300:00	–	bdu_fstec
Chainguard	CVE-2023-3676 vulnerabilities	31 Oct 202321:15	–	cgr
Circl	CVE-2023-3676	24 Aug 202308:20	–	circl
CNNVD	Kubernetes 输入验证错误漏洞	23 Aug 202300:00	–	cnnvd
CVE	CVE-2023-3676	31 Oct 202320:22	–	cve
Debian CVE	CVE-2023-3676	31 Oct 202320:22	–	debiancve
Fedora	[SECURITY] Fedora 38 Update: kubernetes-1.26.8-1.fc38	2 Sep 202301:16	–	fedora

[
  {
    "defaultStatus": "unaffected",
    "product": "kubelet",
    "repo": "https://github.com/kubernetes/kubernetes",
    "vendor": "Kubernetes",
    "versions": [
      {
        "status": "affected",
        "version": "v1.28.0"
      },
      {
        "lessThanOrEqual": "v1.27.4",
        "status": "affected",
        "version": "v1.27.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "v1.26.7",
        "status": "affected",
        "version": "v1.26.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "v1.25.12",
        "status": "affected",
        "version": "v1.25.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "v1.28.1"
      },
      {
        "status": "unaffected",
        "version": "v1.27.5"
      },
      {
        "status": "unaffected",
        "version": "v1.26.8"
      },
      {
        "status": "unaffected",
        "version": "v1.25.13"
      },
      {
        "status": "unaffected",
        "version": "v1.24.17"
      },
      {
        "lessThanOrEqual": "v1.24.16",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
groups	www.groups.google.com/g/kubernetes-security-announce/c/d_fvHZ9a5zc
security	www.security.netapp.com/advisory/ntap-20231130-0007/
github	www.github.com/kubernetes/kubernetes/issues/119339

30 Nov 2023 22:06Current

8.8High risk

Vulners AI Score8.8

CVSS 3.18.8

EPSS0.40738

CWE-20