CVE-2023-2728

CVE Details

Release Date:	2023-07-03
Impact:	None	What is this?

Description

Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account's secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with ephemeral containers.

See more information about CVE-2023-2728 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	6.5
Vector String:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Version:	3.0
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	High
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	High
Integrity Impact:	High
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 7 (kubernetes)	ELSA-2023-12562	2023-07-03
Oracle Linux version 7 (kubernetes)	ELSA-2023-12563	2023-07-03
Oracle Linux version 7 (olcne)	ELSA-2023-12562	2023-07-03
Oracle Linux version 7 (olcne)	ELSA-2023-12563	2023-07-03
Oracle Linux version 7 (olcne)	ELSA-2023-25545	2023-07-03
Oracle Linux version 7 (yq)	ELSA-2023-12563	2023-07-03
Oracle Linux version 8 (kubernetes)	ELSA-2023-12561	2023-07-03
Oracle Linux version 8 (kubernetes)	ELSA-2023-12564	2023-07-03
Oracle Linux version 8 (olcne)	ELSA-2023-12561	2023-07-03
Oracle Linux version 8 (olcne)	ELSA-2023-12564	2023-07-03
Oracle Linux version 8 (olcne)	ELSA-2023-25546	2023-07-03
Oracle Linux version 8 (yq)	ELSA-2023-12564	2023-07-03