CVE-2023-5528
CVE-2023-5528 · Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.
CVSS 7.2 · Élevée · EPSS 4,1% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: containers
Produits et versions concernés
kubernetes
- Versions du logiciel
- ≥ v1.28.0, ≤ v1.28.3: Concernée (semver)
- ≥ v1.27.0, ≤ v1.27.7: Concernée (semver)
- ≥ v1.26.0, ≤ v1.26.10: Concernée (semver)
- ≥ 0, ≤ v1.25.15: Concernée (semver)
- v1.28.4: Non concernée
- v1.27.8: Non concernée
- v1.26.11: Non concernée
- v1.25.16: Non concernée
Mettez à jour vers v1.25.16; Mettez à jour vers v1.26.11; Mettez à jour vers v1.27.8; Mettez à jour vers v1.28.4
Sources originales
- https://github.com/kubernetes/kubernetes/issues/121879
- https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzA
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4XZIX727JIKF5RQW7RVVBLWXBCDIBJA7/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7MPGMITSZXUCAVO7Q75675SOLXC2XXU4/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3JH444PWZBINXLLFV7XLIJIZJHSK6UEZ/
- https://security.netapp.com/advisory/ntap-20240119-0009/
- https://nvd.nist.gov/vuln/detail/CVE-2023-5528