SUSE-SU-2023:2544-1 Security update for kubernetes1.24

This update for kubernetes1.24 fixes the following issues: - CVE-2023-2727: Fixed bypassing policies imposed by the ImagePolicyWebhook admission plugin bsc1211630. - CVE-2023-2728: Fixed bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin bsc1211631...

SUSE-SU-2023:2543-1 Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues: - CVE-2023-2727: Fixed bypassing policies imposed by the ImagePolicyWebhook admission plugin bsc1211630. - CVE-2023-2728: Fixed bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin bsc1211631...

Top Security Talks from KubeCon Europe 2023

KubeCon Europe is the largest open-source community conference in Europe with hundreds of talks. We picked our favorite Kubernetes security sessions available online...

14 Kubernetes and Cloud Security Challenges and How to Solve Them

Recently, Andrew Martin, founder and CEO of ControlPlane, released a report entitled Cloud Native and Kubernetes Security Predictions 2023. These predictions underscore the rapidly evolving landscape of Kubernetes and cloud security, emphasizing the need for organizations to stay informed and ado...

SUSE CVE-2023-26484

KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-handler the KubeVirt node-daemon is running, the virt-handler service account can be used to modify all node specs. This can be misused to...

Enhancing Kubernetes security with user namespaces

Learn how to improve cluster security with user namespaces, a new feature introduced in Kubernetes v1.25...

CVE-2022-23551 AAD Pod Identity obtaining token with backslash

aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request...

OESA-2022-2132 kubernetes security update

Container cluster management. Security Fixes: kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.CVE-2021-25743...

This Week in Spring - June 14th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Ive just arrived in beautiful Berlin, Germany, for the forthcoming We Are Developers show with more than five thousand attendees. I was in Toronto, Canada, for the epic SpringOne Tour installment there. Ive also had the...

GHSA-GC2P-G4FG-29VH Kubernetes did not effectively clear service account credentials

In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig method returns a copy of the provided config, with credentials removed bearer token, username/password, and client certificate/key data. In the affected versions, rest.AnonymousClientConfig did not effectively clear service...

The Fault in Our kubelets: Analyzing the Security of Publicly Exposed Kubernetes Clusters

While researching cloud-native tools, our Shodan scan revealed over 200,000 publicly exposed Kubernetes clusters and kubelet ports that can be abused by criminals...

CVE-2022-29164 Privilege Escalation in argo-workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

Deep Dive: Protecting Against Container Threats in the Cloud

Containers are self-contained pods representing complete, portable application environments. They contain everything an application needs to run, including binaries, libraries, configuration files and dependencies Docker and Amazon Elastic, for instance, are two of the more well-known offerings...

GHSA-MQF3-28J7-3MJ6 Information Exposure in Kubernetes

Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name...

Information Exposure in Kubernetes

Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name...

kubernetes-client: Insecure deserialization in unmarshalYaml method

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML...

PT-2022-1850 · Cri-O +2 · Cri-O +2

Name of the Vulnerable Software and Affected Versions: CRI-O versions 1.19 through 1.23.1 CRI-O versions prior to 1.19.6 CRI-O versions prior to 1.20.7 CRI-O versions prior to 1.21.6 CRI-O versions prior to 1.22.3 CRI-O versions prior to 1.23.2 CRI-O version 1.24.0 and earlier Description: A flaw...

Kubernetes: Ingress-nginx path allows retrieval of ingress-nginx serviceaccount token

Report Submission Form Summary: A user with the permissions to create an ingress resource can obtain the ingress-nginx service account token which can list secrets is all namespaces cluster wide. Kubernetes Version: 1.20 should work on 1.21 as well Component Version: nginx ingress controller v1.0...

CVE-2021-25740

A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack...

Kubernetes Clusters Targeted by Siloscape Malware

By Deeba Ahmed Siloscape is regarded as an unusual malware that focuses on Linux as the preferred OS for managing cloud environments and applications. This is a post from HackRead.com Read the original post: Kubernetes Clusters Targeted by Siloscape Malware...