Patchwire CVEs, their patch status, and feeds to follow them

CVE-2024-3177

Fixed in a distro release EPSS 2%CVSS 2.7

A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.

Published 2024-04-22 · CVE record · OSV

Products: Kubernetes

Fixed upstream

EcosystemPackageFixed in
Gok8s.io/kubernetes1.27.13
Gok8s.io/kubernetes1.29.4
Gok8s.io/kubernetes1.28.9

Distro releases

ReleasePackageFixed in
Chainguardargo-cd-2.11no fix
Chainguardargocd-image-updater0.17.0-r1
Chainguardargocd-image-updater-compat0.17.0-r1
Chainguardargocd-image-updater-fips0.17.0-r2
Chainguardaws-ebs-csi-driver1.30.0-r0
Chainguardaws-ebs-csi-driver-1.181.18.0-r16
Chainguardaws-ebs-csi-driver-1.191.19.0-r15
Chainguardaws-ebs-csi-driver-fips1.30.0-r0
Chainguardaws-efs-csi-driver2.1.1-r0
Chainguardaws-efs-csi-driver-fips2.1.14-r1
Chainguardaws-efs-csi-driver-fips1.7.0-r9
Chainguardaws-efs-csi-driver-fips-1.61.6.0-r9
Chainguardcalico3.28.0-r0
Chainguardcalico-apiserver3.28.0-r0
Chainguardcalico-app-policy3.28.0-r0
Chainguardcalico-cni3.28.0-r0
Chainguardcalico-cni-compat3.28.0-r0
Chainguardcalico-cni-fips-compat3.28.0-r0
Chainguardcalico-felix3.28.0-r0
Chainguardcalico-fips3.28.0-r0
Chainguardcalico-fips-3.253.25.2-r5
Chainguardcalico-fips-apiserver3.28.0-r0
Chainguardcalico-fips-app-policy3.28.0-r0
Chainguardcalico-fips-cni3.28.0-r0
Chainguardcalico-fips-felix3.28.0-r0
Chainguardcalico-fips-key-cert-provisioner3.28.0-r0
Chainguardcalico-fips-kube-controllers3.28.0-r0
Chainguardcalico-fips-node3.28.0-r0
Chainguardcalico-fips-pod2daemon3.28.0-r0
Chainguardcalico-fips-typha-client3.28.0-r0
Chainguardcalico-fips-typhad3.28.0-r0
Chainguardcalico-key-cert-provisioner3.28.0-r0
Chainguardcalico-kube-controllers3.28.0-r0
Chainguardcalico-node3.28.0-r0
Chainguardcalico-pod2daemon3.28.0-r0
Chainguardcalico-pod2daemon-flexvol-compat3.28.0-r0
Chainguardcalico-typha-client3.28.0-r0
Chainguardcalico-typhad3.28.0-r0
Chainguardcalicoctl3.28.0-r0
Chainguardcalicoctl-fips3.28.0-r0
Chainguardcluster-autoscaler-1.250
Chainguardcluster-autoscaler-1.25-compat0
Chainguardcluster-autoscaler-1.260
Chainguardcluster-autoscaler-1.26-compat0
Chainguardcluster-autoscaler-1.271.27.7-r2
Chainguardcluster-autoscaler-1.27-compat1.27.7-r2
Chainguardcluster-autoscaler-1.281.28.4-r2
Chainguardcluster-autoscaler-1.28-compat1.28.4-r2
Chainguardcluster-autoscaler-1.291.29.2-r2
Chainguardcluster-autoscaler-1.29-compat1.29.2-r2
Chainguardcluster-autoscaler-fips-1.260
Chainguardcluster-autoscaler-fips-1.26-compat0
Chainguardcluster-autoscaler-fips-1.271.27.7-r2
Chainguardcluster-autoscaler-fips-1.27-compat1.27.7-r2
Chainguardcluster-autoscaler-fips-1.281.28.4-r2
Chainguardcluster-autoscaler-fips-1.28-compat1.28.4-r2
Chainguardcluster-autoscaler-fips-1.291.29.2-r2
Chainguardcluster-autoscaler-fips-1.29-compat1.29.2-r2
Chainguardip-masq-agent2.9.3-r10
Chainguardkube-apiserver-1.271.27.13-r0
Chainguardkube-apiserver-1.27-default1.27.13-r0
Chainguardkube-apiserver-1.281.28.9-r0
Chainguardkube-apiserver-1.28-default1.28.9-r0
Chainguardkube-apiserver-1.291.29.4-r0
Chainguardkube-apiserver-1.29-default1.29.4-r0
Chainguardkube-apiserver-fips-1.271.27.14-r0
Chainguardkube-apiserver-fips-1.27-default1.27.14-r0
Chainguardkube-apiserver-fips-1.281.28.9-r0
Chainguardkube-apiserver-fips-1.28-default1.28.9-r0
Chainguardkube-apiserver-fips-1.291.29.4-r0
Chainguardkube-apiserver-fips-1.29-default1.29.4-r0
Chainguardkube-controller-manager-1.271.27.13-r0
Chainguardkube-controller-manager-1.27-default1.27.13-r0
Chainguardkube-controller-manager-1.281.28.9-r0
Chainguardkube-controller-manager-1.28-default1.28.9-r0
Chainguardkube-controller-manager-1.291.29.4-r0
Chainguardkube-controller-manager-1.29-default1.29.4-r0
Chainguardkube-controller-manager-fips-1.271.27.14-r0
Chainguardkube-controller-manager-fips-1.27-default1.27.14-r0
Chainguardkube-controller-manager-fips-1.281.28.9-r0
Chainguardkube-controller-manager-fips-1.28-default1.28.9-r0
Chainguardkube-controller-manager-fips-1.291.29.4-r0
Chainguardkube-controller-manager-fips-1.29-default1.29.4-r0
Chainguardkube-proxy-1.271.27.13-r0
Chainguardkube-proxy-1.27-default1.27.13-r0
Chainguardkube-proxy-1.281.28.9-r0
Chainguardkube-proxy-1.28-default1.28.9-r0
Chainguardkube-proxy-1.28-default-compat1.28.9-r0
Chainguardkube-proxy-1.291.29.4-r0
Chainguardkube-proxy-1.29-default1.29.4-r0
Chainguardkube-proxy-1.29-default-compat1.29.4-r0
Chainguardkube-proxy-fips-1.271.27.14-r0
Chainguardkube-proxy-fips-1.27-default1.27.14-r0
Chainguardkube-proxy-fips-1.281.28.9-r0
Chainguardkube-proxy-fips-1.28-default1.28.9-r0
Chainguardkube-proxy-fips-1.291.29.4-r0
Chainguardkube-proxy-fips-1.29-default1.29.4-r0
Chainguardkube-scheduler-1.271.27.13-r0
Chainguardkube-scheduler-1.27-default1.27.13-r0
Chainguardkube-scheduler-1.281.28.9-r0
Chainguardkube-scheduler-1.28-default1.28.9-r0
Chainguardkube-scheduler-1.291.29.4-r0
Chainguardkube-scheduler-1.29-default1.29.4-r0
Chainguardkube-scheduler-fips-1.271.27.14-r0
Chainguardkube-scheduler-fips-1.27-default1.27.14-r0
Chainguardkube-scheduler-fips-1.281.28.9-r0
Chainguardkube-scheduler-fips-1.28-default1.28.9-r0
Chainguardkube-scheduler-fips-1.291.29.4-r0
Chainguardkube-scheduler-fips-1.29-default1.29.4-r0
Chainguardkubeadm-1.271.27.13-r0
Chainguardkubeadm-1.27-default1.27.13-r0
Chainguardkubeadm-1.281.28.9-r0
Chainguardkubeadm-1.28-default1.28.9-r0
Chainguardkubeadm-1.291.29.4-r0
Chainguardkubeadm-1.29-default1.29.4-r0
Chainguardkubeadm-fips-1.271.27.14-r0
Chainguardkubeadm-fips-1.27-default1.27.14-r0
Chainguardkubeadm-fips-1.281.28.9-r0
Chainguardkubeadm-fips-1.28-default1.28.9-r0
Chainguardkubeadm-fips-1.291.29.4-r0
Chainguardkubeadm-fips-1.29-default1.29.4-r0
Chainguardkubectl-1.271.27.13-r0
Chainguardkubectl-1.27-default1.27.13-r0
Chainguardkubectl-1.281.28.9-r0
Chainguardkubectl-1.28-bitnami-compat1.28.9-r0
Chainguardkubectl-1.28-default1.28.9-r0
Chainguardkubectl-1.291.29.4-r0
Chainguardkubectl-1.29-bitnami-compat1.29.4-r0
Chainguardkubectl-1.29-default1.29.4-r0
Chainguardkubectl-1.29-iamguarded-compat1.29.4-r0
Chainguardkubectl-bash-completion-1.271.27.13-r0
Chainguardkubectl-bash-completion-1.281.28.9-r0
Chainguardkubectl-bash-completion-1.291.29.4-r0
Chainguardkubectl-bash-completion-fips-1.271.27.14-r0
Chainguardkubectl-bash-completion-fips-1.281.28.9-r0
Chainguardkubectl-bash-completion-fips-1.291.29.4-r0
Chainguardkubectl-fips-1.271.27.14-r0
Chainguardkubectl-fips-1.27-default1.27.14-r0
Chainguardkubectl-fips-1.281.28.9-r0
Chainguardkubectl-fips-1.28-default1.28.9-r0
Chainguardkubectl-fips-1.291.29.4-r0
Chainguardkubectl-fips-1.29-default1.29.4-r0
Chainguardkubeflow-pipelines2.14.3-r3
Chainguardkubeflow-pipelines-apiserver2.14.3-r3
Chainguardkubeflow-pipelines-cache-deployer2.14.3-r3
Chainguardkubeflow-pipelines-cache-deployer-compat2.14.3-r3
Chainguardkubeflow-pipelines-cache_server2.14.3-r3
Chainguardkubeflow-pipelines-frontend2.14.3-r3
Chainguardkubeflow-pipelines-metadata-envoy-config2.14.3-r3
Chainguardkubeflow-pipelines-metadata-writer2.14.3-r3
Chainguardkubeflow-pipelines-metadata-writer-compat2.14.3-r3
Chainguardkubeflow-pipelines-persistence_agent2.14.3-r3
Chainguardkubeflow-pipelines-scheduledworkflow2.14.3-r3
Chainguardkubeflow-pipelines-viewer-crd-controller2.14.3-r3
Chainguardkubelet-1.271.27.13-r0
Chainguardkubelet-1.27-default1.27.13-r0
Chainguardkubelet-1.281.28.9-r0
Chainguardkubelet-1.28-default1.28.9-r0
Chainguardkubelet-1.291.29.4-r0
Chainguardkubelet-1.29-default1.29.4-r0
Chainguardkubelet-fips-1.271.27.14-r0
Chainguardkubelet-fips-1.27-default1.27.14-r0
Chainguardkubelet-fips-1.281.28.9-r0
Chainguardkubelet-fips-1.28-default1.28.9-r0
Chainguardkubelet-fips-1.291.29.4-r0
Chainguardkubelet-fips-1.29-default1.29.4-r0
Chainguardkubernetes-1.271.27.13-r0
Chainguardkubernetes-1.27-default1.27.13-r0
Chainguardkubernetes-1.281.28.9-r0
Chainguardkubernetes-1.28-default1.28.9-r0
Chainguardkubernetes-1.291.29.4-r0
Chainguardkubernetes-1.29-default1.29.4-r0
Chainguardkubernetes-csi-driver-hostpath1.13.0-r3
Chainguardkubernetes-dns-node-cache1.23.0-r5
Chainguardkubernetes-fips-1.271.27.14-r0
Chainguardkubernetes-fips-1.27-default1.27.14-r0
Chainguardkubernetes-fips-1.281.28.9-r0
Chainguardkubernetes-fips-1.28-default1.28.9-r0
Chainguardkubernetes-fips-1.291.29.4-r0
Chainguardkubernetes-fips-1.29-default1.29.4-r0
Chainguardkubernetes-pause-1.281.28.9-r0
Chainguardkubernetes-pause-1.291.29.4-r0
Chainguardkubernetes-pause-compat-1.281.28.9-r0
Chainguardkubernetes-pause-compat-1.291.29.4-r0
Chainguardkubernetes-pause-fips-3.91.28.9-r0
Chainguardlocal-static-provisioner2.7.0-r1
Chainguardlocal-static-provisioner-compat2.7.0-r1
Chainguardlocal-volume-node-cleanup2.7.0-r1
Chainguardlocal-volume-node-cleanup-compat2.7.0-r1
Chainguardnode-feature-discovery-0.140.14.6-r2
Chainguardnode-feature-discovery-0.150.15.4-r2
Chainguardnodetaint0.0.4-r16
Chainguardrancher-webhook-0.40.4.18-r6
Chainguardrancher-webhook-0.40.4.9-r1
Chainguardrancher-webhook-fips-0.40.4.18-r4
Chainguardspark-operator1.2.12-r1
Chainguardspark-operator-oci-entrypoint1.2.12-r1
Chainguardsparkctl1.2.12-r1
Debian 12kubernetes1.20.5+really1.20.2-1
Debian 13kubernetes1.20.5+really1.20.2-1
Debian 14kubernetes1.20.5+really1.20.2-1
Red Hat openshift 4.14openshift0:4.14.0-202404231437.p0.g401bb48.assembly.stream.el9
Red Hat openshift 4.14openshift0:4.14.0-202404231437.p0.g401bb48.assembly.stream.el8
Red Hat openshift 4.14openshift-hyperkube0:4.14.0-202404231437.p0.g401bb48.assembly.stream.el9
Red Hat openshift 4.14openshift-hyperkube0:4.14.0-202404231437.p0.g401bb48.assembly.stream.el8
Red Hat openshift 4.14skopeo2:1.11.3-0.1.rhaos4.14.el8
Red Hat openshift 4.14skopeo2:1.11.3-0.1.rhaos4.14.el9
Red Hat openshift 4.14skopeo-debuginfo2:1.11.3-0.1.rhaos4.14.el9
Red Hat openshift 4.14skopeo-debuginfo2:1.11.3-0.1.rhaos4.14.el8
Red Hat openshift 4.14skopeo-debugsource2:1.11.3-0.1.rhaos4.14.el8
Red Hat openshift 4.14skopeo-debugsource2:1.11.3-0.1.rhaos4.14.el9
Red Hat openshift 4.14skopeo-tests2:1.11.3-0.1.rhaos4.14.el9
Red Hat openshift 4.14skopeo-tests2:1.11.3-0.1.rhaos4.14.el8
Red Hat openshift 4.16microshift0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9
Red Hat openshift 4.16microshift-greenboot0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9
Red Hat openshift 4.16microshift-multus0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9
Red Hat openshift 4.16microshift-multus-release-info0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9
Red Hat openshift 4.16microshift-networking0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9
Red Hat openshift 4.16microshift-olm0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9
Red Hat openshift 4.16microshift-olm-release-info0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9
Red Hat openshift 4.16microshift-release-info0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9
Red Hat openshift 4.16microshift-selinux0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9
SUSE Enterprise Storage 7.1kubernetes1.231.23.17-150300.7.12.1
SUSE Enterprise Storage 7.1kubernetes1.241.24.17-150300.7.6.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSSkubernetes1.231.23.17-150300.7.12.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSSkubernetes1.241.24.17-150300.7.6.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSkubernetes1.231.23.17-150300.7.12.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSkubernetes1.241.24.17-150400.9.16.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSkubernetes1.231.23.17-150300.7.12.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSkubernetes1.241.24.17-150400.9.16.1
SUSE Linux Enterprise Module for Containers 15 SP5kubernetes1.231.23.17-150500.3.12.1
SUSE Linux Enterprise Module for Containers 15 SP5kubernetes1.241.24.17-150500.3.16.1
SUSE Linux Enterprise Server 15 SP3-LTSSkubernetes1.231.23.17-150300.7.12.1
SUSE Linux Enterprise Server 15 SP3-LTSSkubernetes1.241.24.17-150300.7.6.1
SUSE Linux Enterprise Server 15 SP4-LTSSkubernetes1.231.23.17-150300.7.12.1
SUSE Linux Enterprise Server 15 SP4-LTSSkubernetes1.241.24.17-150400.9.16.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3kubernetes1.231.23.17-150300.7.12.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3kubernetes1.241.24.17-150300.7.6.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4kubernetes1.231.23.17-150300.7.12.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4kubernetes1.241.24.17-150400.9.16.1
Ubuntu 22.04 LTSkubernetesno fix
Ubuntu 24.04 LTSkubernetesno fix
Ubuntu Pro 20.04 LTSkubernetesno fix
Wolfiargocd-image-updater0.17.0-r1
Wolfiargocd-image-updater-compat0.17.0-r1
Wolfiaws-ebs-csi-driver1.30.0-r0
Wolfiaws-efs-csi-driver2.1.1-r0
Wolficalico3.28.0-r0
Wolficalico-apiserver3.28.0-r0
Wolficalico-app-policy3.28.0-r0
Wolficalico-cni3.28.0-r0
Wolficalico-cni-compat3.28.0-r0
Wolficalico-felix3.28.0-r0
Wolficalico-key-cert-provisioner3.28.0-r0
Wolficalico-kube-controllers3.28.0-r0
Wolficalico-node3.28.0-r0
Wolficalico-pod2daemon3.28.0-r0
Wolficalico-pod2daemon-flexvol-compat3.28.0-r0
Wolficalico-typha-client3.28.0-r0
Wolficalico-typhad3.28.0-r0
Wolficalicoctl3.28.0-r0
Wolficluster-autoscaler-1.250
Wolficluster-autoscaler-1.25-compat0
Wolficluster-autoscaler-1.260
Wolficluster-autoscaler-1.26-compat0
Wolficluster-autoscaler-1.271.27.7-r2
Wolficluster-autoscaler-1.27-compat1.27.7-r2
Wolficluster-autoscaler-1.281.28.4-r2
Wolficluster-autoscaler-1.28-compat1.28.4-r2
Wolficluster-autoscaler-1.291.29.2-r2
Wolficluster-autoscaler-1.29-compat1.29.2-r2
Wolfiip-masq-agent2.9.3-r10
Wolfikube-apiserver-1.271.27.13-r0
Wolfikube-apiserver-1.27-default1.27.13-r0
Wolfikube-apiserver-1.281.28.9-r0
Wolfikube-apiserver-1.28-default1.28.9-r0
Wolfikube-apiserver-1.291.29.4-r0
Wolfikube-apiserver-1.29-default1.29.4-r0
Wolfikube-controller-manager-1.271.27.13-r0
Wolfikube-controller-manager-1.27-default1.27.13-r0
Wolfikube-controller-manager-1.281.28.9-r0
Wolfikube-controller-manager-1.28-default1.28.9-r0
Wolfikube-controller-manager-1.291.29.4-r0
Wolfikube-controller-manager-1.29-default1.29.4-r0
Wolfikube-proxy-1.271.27.13-r0
Wolfikube-proxy-1.27-default1.27.13-r0
Wolfikube-proxy-1.281.28.9-r0
Wolfikube-proxy-1.28-default1.28.9-r0
Wolfikube-proxy-1.291.29.4-r0
Wolfikube-proxy-1.29-default1.29.4-r0
Wolfikube-scheduler-1.271.27.13-r0
Wolfikube-scheduler-1.27-default1.27.13-r0
Wolfikube-scheduler-1.281.28.9-r0
Wolfikube-scheduler-1.28-default1.28.9-r0
Wolfikube-scheduler-1.291.29.4-r0
Wolfikube-scheduler-1.29-default1.29.4-r0
Wolfikubeadm-1.271.27.13-r0
Wolfikubeadm-1.27-default1.27.13-r0
Wolfikubeadm-1.281.28.9-r0
Wolfikubeadm-1.28-default1.28.9-r0
Wolfikubeadm-1.291.29.4-r0
Wolfikubeadm-1.29-default1.29.4-r0
Wolfikubectl-1.271.27.13-r0
Wolfikubectl-1.27-default1.27.13-r0
Wolfikubectl-1.281.28.9-r0
Wolfikubectl-1.28-default1.28.9-r0
Wolfikubectl-1.291.29.4-r0
Wolfikubectl-1.29-default1.29.4-r0
Wolfikubectl-bash-completion-1.271.27.13-r0
Wolfikubectl-bash-completion-1.281.28.9-r0
Wolfikubectl-bash-completion-1.291.29.4-r0
Wolfikubeflow-pipelines2.14.3-r3
Wolfikubeflow-pipelines-apiserver2.14.3-r3
Wolfikubeflow-pipelines-cache-deployer2.14.3-r3
Wolfikubeflow-pipelines-cache-deployer-compat2.14.3-r3
Wolfikubeflow-pipelines-cache_server2.14.3-r3
Wolfikubeflow-pipelines-frontend2.14.3-r3
Wolfikubeflow-pipelines-metadata-envoy-config2.14.3-r3
Wolfikubeflow-pipelines-metadata-writer2.14.3-r3
Wolfikubeflow-pipelines-metadata-writer-compat2.14.3-r3
Wolfikubeflow-pipelines-persistence_agent2.14.3-r3
Wolfikubeflow-pipelines-scheduledworkflow2.14.3-r3
Wolfikubeflow-pipelines-viewer-crd-controller2.14.3-r3
Wolfikubelet-1.271.27.13-r0
Wolfikubelet-1.27-default1.27.13-r0
Wolfikubelet-1.281.28.9-r0
Wolfikubelet-1.28-default1.28.9-r0
Wolfikubelet-1.291.29.4-r0
Wolfikubelet-1.29-default1.29.4-r0
Wolfikubernetes-1.271.27.13-r0
Wolfikubernetes-1.27-default1.27.13-r0
Wolfikubernetes-1.281.28.9-r0
Wolfikubernetes-1.28-default1.28.9-r0
Wolfikubernetes-1.291.29.4-r0
Wolfikubernetes-1.29-default1.29.4-r0
Wolfikubernetes-csi-driver-hostpath1.13.0-r3
Wolfikubernetes-dns-node-cache1.23.0-r5
Wolfilocal-static-provisioner2.7.0-r1
Wolfilocal-static-provisioner-compat2.7.0-r1
Wolfilocal-volume-node-cleanup2.7.0-r1
Wolfilocal-volume-node-cleanup-compat2.7.0-r1
Wolfinode-feature-discovery-0.150.15.4-r2
Wolfinodetaint0.0.4-r16
Wolfispark-operator1.2.12-r1
Wolfispark-operator-oci-entrypoint1.2.12-r1
Wolfisparkctl1.2.12-r1
openSUSE Leap 15.5kubernetes1.231.23.17-150500.3.12.1
openSUSE Leap 15.5kubernetes1.241.24.17-150500.3.16.1