An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2023-1260 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2176267 | Issue Tracking Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2023:4312 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2023:4093 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2023:3976 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2023:4898 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20231020-0010/ | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2023:5008 | |
| https://github.com/advisories/GHSA-92hx-3mh6-hc49 |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
03 May 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Dec 2023, 18:19
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.0 |
16 Nov 2023, 00:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://security.netapp.com/advisory/ntap-20231020-0010/ - Third Party Advisory |
20 Oct 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-24 01:15
Updated : 2024-05-03 16:15
NVD link : CVE-2023-1260
Mitre link : CVE-2023-1260
JSON object : View
Products Affected
kubernetes
- kube-apiserver
redhat
- openshift_container_platform
CWE