CVE-2023-1260
Fixed in a distro release EPSS 2%CVSS 8.0
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
Products: Red Hat OpenShift Container Platform 4.10, Red Hat OpenShift Container Platform 4.11, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/openshift/apiserver-library-go | 0.0.0-20230621 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 4.10 | openshift | 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift | 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7 |
| Red Hat openshift 4.10 | openshift-hyperkube | 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift-hyperkube | 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7 |
| Red Hat openshift 4.11 | openshift | 0:4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8 |
| Red Hat openshift 4.11 | openshift-hyperkube | 0:4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8 |
| Red Hat openshift 4.12 | openshift | 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9 |
| Red Hat openshift 4.12 | openshift | 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el8 |
| Red Hat openshift 4.12 | openshift-hyperkube | 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el8 |
| Red Hat openshift 4.12 | openshift-hyperkube | 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9 |
| Red Hat openshift 4.13 | openshift | 0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el8 |
| Red Hat openshift 4.13 | openshift | 0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el9 |
| Red Hat openshift 4.13 | openshift-clients | 0:4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el9 |
| Red Hat openshift 4.13 | openshift-clients | 0:4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8 |
| Red Hat openshift 4.13 | openshift-clients-redistributable | 0:4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el9 |
| Red Hat openshift 4.13 | openshift-clients-redistributable | 0:4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8 |
| Red Hat openshift 4.13 | openshift-hyperkube | 0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el9 |
| Red Hat openshift 4.13 | openshift-hyperkube | 0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el8 |
| Red Hat openshift 4.14 | microshift | 0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 |
| Red Hat openshift 4.14 | microshift-networking | 0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 |
| Red Hat openshift 4.14 | microshift-release-info | 0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 |
| Red Hat openshift 4.14 | microshift-selinux | 0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 |