An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2023:3976 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2023:4093 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2023:4312 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2023:4898 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2023:5008 | |
| https://access.redhat.com/security/cve/CVE-2023-1260 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2176267 | Issue Tracking Third Party Advisory |
| https://github.com/advisories/GHSA-92hx-3mh6-hc49 | |
| https://security.netapp.com/advisory/ntap-20231020-0010/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
03 May 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Dec 2023, 18:19
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.0 |
16 Nov 2023, 00:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://security.netapp.com/advisory/ntap-20231020-0010/ - Third Party Advisory |
20 Oct 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
26 Sep 2023, 16:21
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
| CPE | cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:* cpe:2.3:a:kubernetes:kube-apiserver:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.13:*:*:*:*:*:*:* |
|
| CWE | NVD-CWE-Other | |
| References | (MISC) https://access.redhat.com/errata/RHSA-2023:3976 - Third Party Advisory | |
| References | (MISC) https://access.redhat.com/errata/RHSA-2023:4312 - Third Party Advisory | |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2176267 - Issue Tracking, Third Party Advisory | |
| References | (MISC) https://access.redhat.com/errata/RHSA-2023:4093 - Third Party Advisory | |
| References | (MISC) https://access.redhat.com/security/cve/CVE-2023-1260 - Third Party Advisory | |
| References | (MISC) https://access.redhat.com/errata/RHSA-2023:4898 - Third Party Advisory | |
| First Time |
Redhat openshift Container Platform
Redhat Kubernetes Kubernetes kube-apiserver |
24 Sep 2023, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-24 01:15
Updated : 2024-05-03 16:15
NVD link : CVE-2023-1260
Mitre link : CVE-2023-1260
CVE.ORG link : CVE-2023-1260
JSON object : View
Products Affected
kubernetes
- kube-apiserver
redhat
- openshift_container_platform
CWE