SB2023052522 - SUSE update for kubernetes1.23 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023052522

SB2023052522 - SUSE update for kubernetes1.23

Published: May 25, 2023

Security Bulletin ID SB2023052522
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-25749)

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due incorrect privilege management. Windows workloads can be executed with the ContainerAdministrator privileges even when the runAsNonRoot option is set to "true".


2) Improper access control (CVE-ID: CVE-2022-3162)

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different kind in the same API group they are not authorized to read.


3) Input validation error (CVE-ID: CVE-2022-3294)

The vulnerability allows a remote user to execute arbitrary cod on the system.

The vulnerability exists due to users may have access to secure endpoints in the control plane network. A remote user can trigger the vulnerability and allow authenticated requests destined for Nodes to the API server's private network.


Remediation

Install update from vendor's website.

References