{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"High" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"kubernetes security update", "category":"general", "title":"Synopsis" }, { "text":"An update for kubernetes is now available for openEuler-20.03-LTS-SP3.", "category":"general", "title":"Summary" }, { "text":"Container cluster management.\n\nSecurity Fix(es):\n\nUsers authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.(CVE-2022-3162)\n\nUsers may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network.(CVE-2022-3294)\n\nA security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.(CVE-2023-2431)\n\nUsers may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.\n\n(CVE-2023-2727)\n\nUsers may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.\n\n(CVE-2023-2728)", "category":"general", "title":"Description" }, { "text":"An update for kubernetes is now available for openEuler-20.03-LTS-SP3.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.", "category":"general", "title":"Topic" }, { "text":"High", "category":"general", "title":"Severity" }, { "text":"kubernetes", "category":"general", "title":"Affected Component" } ], "publisher":{ "issuing_authority":"openEuler security committee", "name":"openEuler", "namespace":"https://www.openeuler.org", "contact_details":"openeuler-security@openeuler.org", "category":"vendor" }, "references":[ { "summary":"openEuler-SA-2023-1413", "category":"self", "url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1413" }, { "summary":"CVE-2022-3162", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail?cveId=CVE-2022-3162&packageName=kubernetes" }, { "summary":"CVE-2022-3294", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail?cveId=CVE-2022-3294&packageName=kubernetes" }, { "summary":"CVE-2023-2431", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail?cveId=CVE-2023-2431&packageName=kubernetes" }, { "summary":"CVE-2023-2727", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail?cveId=CVE-2023-2727&packageName=kubernetes" }, { "summary":"CVE-2023-2728", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail?cveId=CVE-2023-2728&packageName=kubernetes" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3162" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3294" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2431" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2727" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2728" }, { "summary":"openEuler-SA-2023-1413 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/advisories/2023/csaf-openeuler-sa-2023-1413.json" } ], "title":"An update for kubernetes is now available for openEuler-20.03-LTS-SP3", "tracking":{ "initial_release_date":"2023-07-08T14:20:16+08:00", "revision_history":[ { "date":"2023-07-08T14:20:16+08:00", "summary":"Initial", "number":"1.0.0" }, { "date":"2024-10-31T14:20:16+08:00", "summary":"final", "number":"2.0.0" } ], "generator":{ "date":"2024-10-31T14:20:16+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2024-10-31T14:20:16+08:00", "id":"openEuler-SA-2023-1413", "version":"2.0.0", "status":"final" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3" }, "product_id":"openEuler-20.03-LTS-SP3", "name":"openEuler-20.03-LTS-SP3" }, "name":"openEuler-20.03-LTS-SP3", "category":"product_version" } ], "category":"product_name" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3" }, "product_id":"kubernetes-kubeadm-1.20.2-20.oe1.aarch64.rpm(20.03-LTS-SP3)", "name":"kubernetes-kubeadm-1.20.2-20.oe1.aarch64.rpm" }, "name":"kubernetes-kubeadm-1.20.2-20.oe1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3" }, "product_id":"kubernetes-client-1.20.2-20.oe1.aarch64.rpm(20.03-LTS-SP3)", "name":"kubernetes-client-1.20.2-20.oe1.aarch64.rpm" }, "name":"kubernetes-client-1.20.2-20.oe1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3" }, "product_id":"kubernetes-master-1.20.2-20.oe1.aarch64.rpm(20.03-LTS-SP3)", "name":"kubernetes-master-1.20.2-20.oe1.aarch64.rpm" }, "name":"kubernetes-master-1.20.2-20.oe1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3" }, "product_id":"kubernetes-1.20.2-20.oe1.aarch64.rpm(20.03-LTS-SP3)", "name":"kubernetes-1.20.2-20.oe1.aarch64.rpm" }, "name":"kubernetes-1.20.2-20.oe1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3" }, "product_id":"kubernetes-node-1.20.2-20.oe1.aarch64.rpm(20.03-LTS-SP3)", "name":"kubernetes-node-1.20.2-20.oe1.aarch64.rpm" }, "name":"kubernetes-node-1.20.2-20.oe1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3" }, "product_id":"kubernetes-kubelet-1.20.2-20.oe1.aarch64.rpm(20.03-LTS-SP3)", "name":"kubernetes-kubelet-1.20.2-20.oe1.aarch64.rpm" }, "name":"kubernetes-kubelet-1.20.2-20.oe1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3" }, "product_id":"kubernetes-help-1.20.2-20.oe1.aarch64.rpm(20.03-LTS-SP3)", "name":"kubernetes-help-1.20.2-20.oe1.aarch64.rpm" }, "name":"kubernetes-help-1.20.2-20.oe1.aarch64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3" }, "product_id":"kubernetes-1.20.2-20.oe1.src.rpm(20.03-LTS-SP3)", "name":"kubernetes-1.20.2-20.oe1.src.rpm" }, "name":"kubernetes-1.20.2-20.oe1.src.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3" }, "product_id":"kubernetes-kubelet-1.20.2-20.oe1.x86_64.rpm(20.03-LTS-SP3)", "name":"kubernetes-kubelet-1.20.2-20.oe1.x86_64.rpm" }, "name":"kubernetes-kubelet-1.20.2-20.oe1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3" }, "product_id":"kubernetes-node-1.20.2-20.oe1.x86_64.rpm(20.03-LTS-SP3)", "name":"kubernetes-node-1.20.2-20.oe1.x86_64.rpm" }, "name":"kubernetes-node-1.20.2-20.oe1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3" }, "product_id":"kubernetes-kubeadm-1.20.2-20.oe1.x86_64.rpm(20.03-LTS-SP3)", "name":"kubernetes-kubeadm-1.20.2-20.oe1.x86_64.rpm" }, "name":"kubernetes-kubeadm-1.20.2-20.oe1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3" }, "product_id":"kubernetes-1.20.2-20.oe1.x86_64.rpm(20.03-LTS-SP3)", "name":"kubernetes-1.20.2-20.oe1.x86_64.rpm" }, "name":"kubernetes-1.20.2-20.oe1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3" }, "product_id":"kubernetes-help-1.20.2-20.oe1.x86_64.rpm(20.03-LTS-SP3)", "name":"kubernetes-help-1.20.2-20.oe1.x86_64.rpm" }, "name":"kubernetes-help-1.20.2-20.oe1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3" }, "product_id":"kubernetes-client-1.20.2-20.oe1.x86_64.rpm(20.03-LTS-SP3)", "name":"kubernetes-client-1.20.2-20.oe1.x86_64.rpm" }, "name":"kubernetes-client-1.20.2-20.oe1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3" }, "product_id":"kubernetes-master-1.20.2-20.oe1.x86_64.rpm(20.03-LTS-SP3)", "name":"kubernetes-master-1.20.2-20.oe1.x86_64.rpm" }, "name":"kubernetes-master-1.20.2-20.oe1.x86_64.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-20.03-LTS-SP3", "product_reference":"kubernetes-kubeadm-1.20.2-20.oe1.aarch64.rpm(20.03-LTS-SP3)", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.aarch64", "name":"kubernetes-kubeadm-1.20.2-20.oe1.aarch64 as a component of openEuler-20.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-20.03-LTS-SP3", "product_reference":"kubernetes-client-1.20.2-20.oe1.aarch64.rpm(20.03-LTS-SP3)", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.aarch64", "name":"kubernetes-client-1.20.2-20.oe1.aarch64 as a component of openEuler-20.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-20.03-LTS-SP3", "product_reference":"kubernetes-master-1.20.2-20.oe1.aarch64.rpm(20.03-LTS-SP3)", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.aarch64", "name":"kubernetes-master-1.20.2-20.oe1.aarch64 as a component of openEuler-20.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-20.03-LTS-SP3", "product_reference":"kubernetes-1.20.2-20.oe1.aarch64.rpm(20.03-LTS-SP3)", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.aarch64", "name":"kubernetes-1.20.2-20.oe1.aarch64 as a component of openEuler-20.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-20.03-LTS-SP3", "product_reference":"kubernetes-node-1.20.2-20.oe1.aarch64.rpm(20.03-LTS-SP3)", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.aarch64", "name":"kubernetes-node-1.20.2-20.oe1.aarch64 as a component of openEuler-20.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-20.03-LTS-SP3", "product_reference":"kubernetes-kubelet-1.20.2-20.oe1.aarch64.rpm(20.03-LTS-SP3)", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.aarch64", "name":"kubernetes-kubelet-1.20.2-20.oe1.aarch64 as a component of openEuler-20.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-20.03-LTS-SP3", "product_reference":"kubernetes-help-1.20.2-20.oe1.aarch64.rpm(20.03-LTS-SP3)", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.aarch64", "name":"kubernetes-help-1.20.2-20.oe1.aarch64 as a component of openEuler-20.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-20.03-LTS-SP3", "product_reference":"kubernetes-1.20.2-20.oe1.src.rpm(20.03-LTS-SP3)", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.src", "name":"kubernetes-1.20.2-20.oe1.src as a component of openEuler-20.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-20.03-LTS-SP3", "product_reference":"kubernetes-kubelet-1.20.2-20.oe1.x86_64.rpm(20.03-LTS-SP3)", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.x86_64", "name":"kubernetes-kubelet-1.20.2-20.oe1.x86_64 as a component of openEuler-20.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-20.03-LTS-SP3", "product_reference":"kubernetes-node-1.20.2-20.oe1.x86_64.rpm(20.03-LTS-SP3)", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.x86_64", "name":"kubernetes-node-1.20.2-20.oe1.x86_64 as a component of openEuler-20.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-20.03-LTS-SP3", "product_reference":"kubernetes-kubeadm-1.20.2-20.oe1.x86_64.rpm(20.03-LTS-SP3)", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.x86_64", "name":"kubernetes-kubeadm-1.20.2-20.oe1.x86_64 as a component of openEuler-20.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-20.03-LTS-SP3", "product_reference":"kubernetes-1.20.2-20.oe1.x86_64.rpm(20.03-LTS-SP3)", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.x86_64", "name":"kubernetes-1.20.2-20.oe1.x86_64 as a component of openEuler-20.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-20.03-LTS-SP3", "product_reference":"kubernetes-help-1.20.2-20.oe1.x86_64.rpm(20.03-LTS-SP3)", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.x86_64", "name":"kubernetes-help-1.20.2-20.oe1.x86_64 as a component of openEuler-20.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-20.03-LTS-SP3", "product_reference":"kubernetes-client-1.20.2-20.oe1.x86_64.rpm(20.03-LTS-SP3)", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.x86_64", "name":"kubernetes-client-1.20.2-20.oe1.x86_64 as a component of openEuler-20.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-20.03-LTS-SP3", "product_reference":"kubernetes-master-1.20.2-20.oe1.x86_64.rpm(20.03-LTS-SP3)", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.x86_64", "name":"kubernetes-master-1.20.2-20.oe1.x86_64 as a component of openEuler-20.03-LTS-SP3" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2022-3162", "notes":[ { "text":"Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.src", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.src", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.x86_64" ], "details":"kubernetes security update", "category":"vendor_fix", "url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1413" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":6.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version":"3.1" }, "products":[ "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.src", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.x86_64" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2022-3162" }, { "cve":"CVE-2022-3294", "notes":[ { "text":"Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server s private network.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.src", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.src", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.x86_64" ], "details":"kubernetes security update", "category":"vendor_fix", "url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1413" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.src", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.x86_64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2022-3294" }, { "cve":"CVE-2023-2431", "notes":[ { "text":"A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.src", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.src", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.x86_64" ], "details":"kubernetes security update", "category":"vendor_fix", "url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1413" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":5.5, "vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.src", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.x86_64" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2023-2431" }, { "cve":"CVE-2023-2727", "notes":[ { "text":"Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.\n\n", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.src", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.src", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.x86_64" ], "details":"kubernetes security update", "category":"vendor_fix", "url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1413" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":6.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.src", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.x86_64" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2023-2727" }, { "cve":"CVE-2023-2728", "notes":[ { "text":"Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.\n\n", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.src", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.x86_64" ] }, "remediations":[ { "product_ids":[ "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.src", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.x86_64" ], "details":"kubernetes security update", "category":"vendor_fix", "url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1413" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":6.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.aarch64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.src", "openEuler-20.03-LTS-SP3:kubernetes-kubelet-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-node-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-kubeadm-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-help-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-client-1.20.2-20.oe1.x86_64", "openEuler-20.03-LTS-SP3:kubernetes-master-1.20.2-20.oe1.x86_64" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2023-2728" } ] }