CVE-2023-2727

2023-06-1505:45:57

redhat.com

access.redhat.com

kubernetes

imagepolicywebhook

ephemeral containers

mitigation

patch

validation webhooks

gatekeeper

kyverno

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

0.001 Low

EPSS

Percentile

38.7%

JSON

A flaw was found in Kubernetes, where users may be able to launch containers using images restricted by the ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

Mitigation

This issue can be mitigated by applying the patch provided for the kube-apiserver component. This patch prevents ephemeral containers from using an image that is restricted by ImagePolicyWebhook.
Note: Validation webhooks, (such as Gatekeeper <https://open-policy-agent.github.io/gatekeeper-library/website/validation/allowedrepos>;
and Kyverno <https://kyverno.io/policies/other/allowed-image-repos/allowed-image-repos/>;) can also be used to enforce the same restrictions.