Published: 24/09/2023 Updated: 15/12/2023

CVSS v3 Base Score: 8 | Impact Score: 6 | Exploitability Score: 1.3

VMScore: 0

An authentication bypass vulnerability exists in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.

Vulnerable Product	Search on Vulmon	Subscribe to Product
kubernetes kube-apiserver -
redhat openshift container platform 4.10
redhat openshift container platform 4.12
redhat openshift container platform 4.11
redhat openshift container platform 4.13

Synopsis Important: OpenShift Container Platform 41224 packages and security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Container Platform release 41224 is now available with updates to p ...

Synopsis Moderate: OpenShift Container Platform 4136 security and extras update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4136 is now available with updates to packages and images that fix several bugsThis release includes a security update for Red Hat OpenShift Container Platform 413R ...

Synopsis Moderate: OpenShift Container Platform 4136 bug fix and security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4136 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Con ...

Synopsis Important: OpenShift Container Platform 41146 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Container Platform release 41146 is now available withupdates to packages and im ...

概述 Important: OpenShift Container Platform 4135 security update 类型/严重性 Security Advisory: Important Red Hat Insights 补丁分析识别并修复受此公告影响的系统。查看受影响的系统标题 Red Hat OpenShift Container Platform release 4135 is now available with updates to packages and images that ...

Synopsis Important: OpenShift Container Platform 41067 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Container Platform release 41067 is now available with updates to packages and i ...

Synopsis Moderate: OpenShift Container Platform 4135 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4135 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Container Platf ...

DescriptionAn authentication bypass vulnerability was discovered in kube-apiserver This issue could allow a remote, authenticated attacker who has been given permissions &quot;update, patch&quot; the &quot;pods/ephemeralcontainers&quot; subresource beyond what the default is They would then need to create a new pod or patch ...

NVD-CWE-Other https://access.redhat.com/security/cve/CVE-2023-1260 https://bugzilla.redhat.com/show_bug.cgi?id=2176267 https://access.redhat.com/errata/RHSA-2023:4312 https://access.redhat.com/errata/RHSA-2023:4093 https://access.redhat.com/errata/RHSA-2023:3976 https://access.redhat.com/errata/RHSA-2023:4898 https://security.netapp.com/advisory/ntap-20231020-0010/https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2023:3976 https://access.redhat.com/security/cve/cve-2023-1260

Get Started

CVE-2023-1260

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect