GO-2023-2159 Kube-proxy may unintentionally forward traffic in k8s.io/kubernetes

Kube-proxy may unintentionally forward traffic in k8s.io/kubernetes...

GO-2023-1891 Vulnerable to policy bypass in kube-apiserver in k8s.io/kubernetes

Vulnerable to policy bypass in kube-apiserver in k8s.io/kubernetes...

The vulnerability of the kube-apiserver component, a software component for managing clusters of virtual machines in Kubernetes, allows a attacker to increase their privileges.

The vulnerability of the kube-apiserver component, which is part of the Kubernetes cluster management software, relates to the redirection of requests for updates to arbitrary resources. Exploiting this vulnerability can allow a remote attacker to increase their privileges...

ROS-20240805-05

Vulnerability in kube-apiserver component of virtual machine cluster management software tool Kubernetes is related to redirection to malicious resources during proxied update requests. Exploitation of the vulnerability could allow an attacker acting remotely to escalate their privileges...

GHSA-5866-49GR-22V4 vulnerabilities

Vulnerabilities for packages: jruby, ruby, kube-fluentd-operator...

GHSA-R55C-59QM-VJW6 vulnerabilities

Vulnerabilities for packages: jruby, ruby, kube-fluentd-operator...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Kubernetes kube-apiserver [ CVE-2024-3177]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Kubernetes kube-apiserver, caused by a flaw when using containers, init containers, and ephemeral containers with the envFrom field populated CVE-2024-3177. Kubernetes...

CVE-2024-41946 vulnerabilities

Vulnerabilities for packages: jruby, ruby, kube-fluentd-operator...

CVE-2024-41123 vulnerabilities

Vulnerabilities for packages: jruby, ruby, kube-fluentd-operator...

Photon OS 3.0: Kube PHSA-2023-3.0-0606

An update of the kube package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-3.0-0606. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2024-24786 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1

CVE-2024-24786 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-39325 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1

CVE-2023-39325 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-47108 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1

CVE-2023-47108 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1. A patched version of the package is available...

CVE-2023-45142 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1

CVE-2023-45142 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-45288 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1

CVE-2023-45288 affecting package kube-vip-cloud-provider for versions less than 0.0.10-1. An upgraded version of the package is available that resolves this issue...

GO-2024-2930 RKE credentials are stored in the RKE1 Cluster state ConfigMap in github.com/rancher/rke

When RKE provisions a cluster, it stores the cluster state in a configmap called "full-cluster-state" inside the "kube-system" namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may include sensitive data...

Moderate: Red Hat Security Advisory: Kube Descheduler Operator for Red Hat OpenShift 5.0.1 for RHEL 9

Kube Descheduler Operator for Red Hat OpenShift 5.0.1 for RHEL 9 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

kubernetes: kube-apiserver: bypassing mountable secrets policy imposed by the ServiceAccount admission plugin

A flaw was found in Kubernetes' kube-apiserver. This flaw allows authenticated users to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated...

RHEL 9 : Red Hat build of MicroShift 4.16.0 (RHSA-2024:0043)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0043 advisory. Red Hat build of MicroShift is Red Hat's light-weight Kubernetes orchestration solution designed for edge device deployments and is built fr...

Sensitive Information Disclosure

github.com/rancher/rke is vulnerable to Sensitive Information Disclosure. The vulnerability exists due to insecure cluster state storage in a publicly accessible configmap called full-cluster-state inside the kube-system namespace, which allows an attacker without administrative privileges to...