GitHub Advisoryadvisory · Go

GHSA-qc2g-gmh6-95p4 kube-apiserver vulnerable to policy bypass

MEDIUM Published 2023-07-03 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-2727
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-20
Reviewed
2023-07-05

Affected packages

• Go k8s.io/kubernetes: >= 1.27.0, < 1.27.3 → fixed in 1.27.3 • Go k8s.io/kubernetes: >= 1.26.0, < 1.26.6 → fixed in 1.26.6 • Go k8s.io/kubernetes: >= 1.25.0, < 1.25.11 → fixed in 1.25.11 • Go k8s.io/kubernetes: < 1.24.15 → fixed in 1.24.15

Description

Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

Related

Alias · CVE (1)

  • CVE-2023-2727 Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References