HIGH8.8
GHSA-q78c-gwqw-jcmc
Kubernetes privilege escalation vulnerability
Quick fix
GHSA-q78c-gwqw-jcmc — k8s.io/kubernetes: upgrade to the fixed version with the command below.
go get k8s.io/kubernetes@v1.28.1Details
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-3955[ADVISORY]
- https://github.com/kubernetes/kubernetes/issues/119595[WEB]
- https://github.com/kubernetes/kubernetes/pull/120128[WEB]
- https://github.com/kubernetes/kubernetes/pull/120134[WEB]
- https://github.com/kubernetes/kubernetes/pull/120135[WEB]
- https://github.com/kubernetes/kubernetes/pull/120136[WEB]
- https://github.com/kubernetes/kubernetes/pull/120137[WEB]
- https://github.com/kubernetes/kubernetes/pull/120138[WEB]
- https://github.com/kubernetes/kubernetes/commit/38c97fa67ed35f36e730856728c9e3807f63546a[WEB]
- https://github.com/kubernetes/kubernetes/commit/50334505cd27cbe7cf71865388f25a00e29b2596[WEB]
- https://github.com/kubernetes/kubernetes/commit/7da6d72c05dffb3b87e62e2bc8c3228ea12ba1b9[WEB]
- https://github.com/kubernetes/kubernetes/commit/b7547e28f898af37aa2f1107a49111f963250fe6[WEB]
- https://github.com/kubernetes/kubernetes/commit/c4e17abb04728e3a3f9bb26e727b0f978df20ec9[WEB]
- https://github.com/kubernetes/kubernetes[PACKAGE]
- https://groups.google.com/g/kubernetes-security-announce/c/JrX4bb7d83E[WEB]
- https://security.netapp.com/advisory/ntap-20231221-0002[WEB]