Database/Container, Kubernetes & orchestration

Kubernetes (kube-apiserver): Ephemeral containers bypass the ImagePolicyWebhook, so unapproved images run

CVSS 6.5CVE-2023-2727Container, Kubernetes & orchestrationcurated

Impact

Ephemeral containers bypass the ImagePolicyWebhook, so unapproved images run

Who can reach it

Cluster user with namespace access

What to do

Rolling control-plane upgrade; no GPU drain

References

https://nvd.nist.gov/vuln/detail/CVE-2023-2727

Related entries

Kubernetes (kube-apiserver): Ephemeral containers bypass the ServiceAccount mountable-secrets policyCVE-2023-2728 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Unvalidated redirect on proxied upgrade requests lets a compromised node escalate to otherCVE-2020-8559 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Any user who can create a Service with externalIPs (or patch LB status) intercepts clusterCVE-2020-8554 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Successful API requests can DoS the apiserverCVE-2020-8552 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Aggregated API server can redirect apiserver clientsCVE-2022-3172 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Admission webhook responses redirect apiserver requests into private networksCVE-2020-8561 · Kubernetes (kube-apiserver)Medium

All Container, Kubernetes & orchestration entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.