Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes Ingress Controller security vulnerabilities (CVE-2023-44487)

Summary IBM Cloud Kubernetes Service is affected by a Kubernetes Ingress Controller security vulnerability that exploits HTTP/2 protocol by allowing a denial of service because request cancellation can reset many streams quickly CVE-2023-44487. Vulnerability Details CVE-2023-44487 Description: Th...

CVE-2023-0923

A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues...

The vulnerability of Microsoft Azure Kubernetes operating systems for Windows is related to deficiencies in access control, allowing attackers to escalate their privileges.

The vulnerability of Microsoft Azure Kubernetes operating systems for Windows is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

CVE-2023-29332

Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability...

CVE-2023-29332 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

...

CVE-2023-29332 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

...

PT-2023-5067 · Microsoft · Azure Kubernetes Service

Name of the Vulnerable Software and Affected Versions: Microsoft Azure Kubernetes Service affected versions not specified Description: The issue is related to insufficient access controls in the Microsoft Azure Kubernetes Service, which can be exploited by a remote attacker to elevate their...

Vulnerabilities fixed in Microsoft Azure

Microsoft has fixed vulnerabilities in components of Azure. A malicious party could exploit the vulnerabilities to gain elevated privileges, execute code with privileges of a user or gain access to sensitive data. Azure DevOps: |----------------|------|-------------------------------------| | CVE...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a kubelet security vulnerability (CVE-2023-2431)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in the kubelet that allows pods to bypass the seccomp profile enforcement CVE-2023-2431 Vulnerability Details CVEID: CVE-2023-2431 Description: Kubernetes could allow a local authenticated attacker to bypass security...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes API server security vulnerability (CVE-2023-2728)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in the Kubernetes API server that enables a user to bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers with the kubernetes.io/enforce-mountable-secrets...

Vulnerabilities fixed in Microsoft Azure

Microsoft has fixed vulnerabilities in Azure components. A malicious party could exploit the vulnerabilities to grant themselves elevated permissions or gain access to sensitive data. Service Fabric: |----------------|------|-------------------------------------| | CVE ID | CVSS | Impact |...

AWS Cloud Development Kit 安全漏洞

AWS Cloud Development Kit is an open source software development framework for defining cloud infrastructure in code and configuring it via AWS CloudFormation. A security vulnerability exists in AWS Cloud Development Kit that stems from two roles created by eks.Cluster and eks.FargateCluster that...

Security Bulletin: IBM Cloud Kubernetes Service is affected by two containerd security vulnerabilities (CVE-2023-28642) (CVE-2023-27561)

Summary IBM Cloud Kubernetes Service is affected by two security vulnerabilities found in containerd where 1 runc could allow a remote attacker to bypass security restrictions, caused by a symbolic link following vulnerability CVE-2023-28642 and 2 runc could allow a local authenticated attacker t...

GHSA-HQ4M-4948-64CC Kyverno resource with a deletionTimestamp may allow policy circumvention

Impact In versions of Kyverno prior to 1.10.0, resources which have the deletionTimestamp field defined can bypass validate, generate, or mutate-existing policies, even in cases where the validationFailureAction field is set to Enforce. This situation occurs as resources pending deletion were bei...

Security Bulletin: IBM Cloud Kubernetes Service is affected by two containerd security vulnerabilities (CVE-2023-25153 and CVE-2023-25173)

Summary IBM Cloud Kubernetes Service is affected by two security vulnerabilities found in containerd where 1 a maliciously crafted image with a large file could cause a denial of service when importing an OCI image CVE-2023-25153 and 2 supplementary groups are not set up properly inside a contain...

Configuring host-level audit logging for AKS VMSS

This blog post runs you through how to enable and configure Linux audit logging on your Azure Kubernetes Service AKS Virtual Machine Scale Set VMSS using the Linux auditing subsystem, also known as auditd. Warning The information provided below is accurate as of the release date of this blog post...

SUSE CVE-2022-29179

Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Prior to versions 1.9.16, 1.10.11, and 1.11.15, if an attacker is able to perform a container escape of a container running as root on a host where Cilium is installed,...

November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities with 10 Critical; Adobe Releases Zero Advisories (for the first time in six years).

Microsoft Patch Tuesday Summary Microsoft has fixed 65 new vulnerabilities aka flaws in the November 2022 update, including ten 10 vulnerabilities classified as Critical as they allow Denial of Service DoS, Elevation of Privilege EoP, and Remote Code Execution RCE. This months Patch Tuesday...

Microsoft is committed to the success of Java developers

Hi, Spring fans! This is a guest post from our friend Julia Liuson, President, Developer Division, Microsoft As a company, we are committed to making Java developers as efficient and productive as possible. This commitment means empowering you to use any tool, framework, and application server on...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a containerd security vulnerability (CVE-2022-29162)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability found in containerd's runc version where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file...