CVE-2023-1260 — Kube-apiserver: privesc

Description (CNA)

An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.

Affected (CNA)

Vendor / product	Versions
Not supplied / Not supplied	unaffected a994128188486d2dce99a528fbcc017d276081e0 before *
Red Hat / Red Hat OpenShift Container Platform 4.10	unaffected 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7 before *
Red Hat / Red Hat OpenShift Container Platform 4.11	unaffected 0:4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.12	unaffected 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9 before *
Red Hat / Red Hat OpenShift Container Platform 4.13	unaffected 0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el8 before *
Red Hat / Red Hat OpenShift Container Platform 4.14	unaffected 0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 before *
Red Hat / Red Hat OpenShift Container Platform 4	unaffected
Red Hat / Red Hat OpenShift Container Platform 4	unaffected
Red Hat / Red Hat OpenShift Container Platform 4	unaffected

CWE

CWE-288

References

ADP enrichment

CVE

No English description supplied.