Cross-site Scripting (XSS)

github.com/rancher/apiserver is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the ParseRequestURL function within base.go constructing a URL from parts of the request without proper sanitization. This flaws allows an attacker to execute arbitrary JavaScript by sending a...

Denial Of Service (DoS)

apimachinery is vulnerable to Denial Of Service DoS. The vulnerability is due to improper depth restrictions when parsing YAML or JSON. This issue can be exploited by an attacker via sending malicious YAML or JSON payloads to cause kube-apiserver to consume excessive CPU or memory, resulting DoS...

RHCOS 4 : OpenShift Container Platform 4.12.24 (RHSA-2023:3976)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:3976 advisory. - kube-apiserver: PrivEsc CVE-2023-1260 Note that Nessus has not tested for this issue but has instead relied only on the application's...

RHCOS 4 : OpenShift Container Platform 4.11.46 (RHSA-2023:4312)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:4312 advisory. - kube-apiserver: PrivEsc CVE-2023-1260 Note that Nessus has not tested for this issue but has instead relied only on the application's...

RHCOS 4 : OpenShift Container Platform 4.10.67 (RHSA-2023:4898)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:4898 advisory. - kube-apiserver: PrivEsc CVE-2023-1260 Note that Nessus has not tested for this issue but has instead relied only on the application's...

SUSE SLES15: containerized-data-importer-api / etc (SUSE-SU-2023:4689-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4689-1 advisory. This update rebuilds containerized-data-importer and its containers against updated GO and updated base images. Tenable has...

PT-2023-36295 · Unknown · Cdi-Uploadserver-Container +7

Name of the Vulnerable Software and Affected Versions: containerized-data-importer versions prior to 1.58.0 cdi-apiserver-container versions prior to 1.58.0 cdi-cloner-container versions prior to 1.58.0 cdi-controller-container versions prior to 1.58.0 cdi-importer-container versions prior to...

Security Bulletin: IBM Storage Fusion may be vulnerable to Unauthorized requests (SSRF), Improper path traversal, via k8s.io/apimachinery, k8s.io/apiserver (CVE-2022-3172, CVE-2022-3162)

Summary Kubernetes' apimachinery and apiserver are used by IBM Storage Fusion to interact with the OpenShift platform. Vulnerabilities in these libraries include the possibility of unauthorized requests server-side request forgery and improper path traversal, as described the the CVEs listed in t...

CVE-2022-3172

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties...

Design/Logic Flaw

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties...

UBUNTU-CVE-2022-3172

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties...

CVE-2022-3172

CVE-2022-3172 : Kubernetes kube-apiserver SSRF vulnerability allowing an aggregated API server to redirect client traffic to an arbitrary URL, potentially causing unintended actions and leaking API server credentials. Connected sources confirm affected product families (kube-apiserver) and that a...

CVE-2022-3172

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties...

kube-apiserver authentication bypass vulnerability

An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch...

CVE-2023-1260

An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch...

Authentication flaw

An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch...

CVE-2023-1260 Kube-apiserver: privesc

An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch...

CVE-2023-1260

CVE-2023-1260 describes an authentication bypass in kube-apiserver within Red Hat OpenShift Container Platform, enabling an authenticated user with update/patch rights on pods/ephemeralcontainers to bypass SCC admission restrictions and gain control of a privileged pod. Affected OpenShift version...

PT-2023-16844 · Kubernetes · Kube-Apiserver

Name of the Vulnerable Software and Affected Versions: kube-apiserver affected versions not specified Description: An authentication bypass issue was discovered in kube-apiserver, allowing a remote, authenticated attacker with update, patch permissions on the pods/ephemeralcontainers subresource ...

RKE2 Security Vulnerability

RKE2 is the next generation Kubernetes distribution for Rancher. A security vulnerability exists in SUSE RKE2 that stems from the presence of a resource allocation error issue. An attacker can exploit the vulnerability to access the apiserver/supervisor port of the K3s server, resulting in a deni...