p PatchFirst

CVE-2023-3676

CVE-2023-3676 · Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

CVSS 8.8 · High · EPSS 13.2% · Fix available

Published
Updated

Stack: system · containers

Affected products and versions

  • kubernetes

    Versions
    • v1.28.0: Affected
    • ≥ v1.27.0, ≤ v1.27.4: Affected (semver)
    • ≥ v1.26.0, ≤ v1.26.7: Affected (semver)
    • ≥ v1.25.0, ≤ v1.25.12: Affected (semver)
    • v1.28.1: Not affected
    • v1.27.5: Not affected
    • v1.26.8: Not affected
    • v1.25.13: Not affected
    • v1.24.17: Not affected
    • ≥ 0, ≤ v1.24.16: Affected (semver)

    No fix published

  • kubernetes Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.20.5+really1.20.2-1

    Update to 1.20.5+really1.20.2-1

  • kubernetes Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.20.5+really1.20.2-1

    Update to 1.20.5+really1.20.2-1

  • kubernetes Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.20.5+really1.20.2-1

    Update to 1.20.5+really1.20.2-1

Original sources

Check your server →