CVE-2023-1260 Kube-apiserver: privesc
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2023-1260?
CVE-2023-1260 is a high-severity vulnerability in Redhat Openshift Container Platform, published on 24 Sep 2023.
Official description
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
Weakness: CWE-288
Which versions are affected by CVE-2023-1260?
2 open source packages ship an affected version, including github.com/openshift/apiserver-library-go. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openshift/apiserver-library-go Go | All versions | 0.0.0-20230621 |
github.com/openshift/apiserver-library-go Go | All versions | 0.0.0-20230621 |
Linux distribution packages (10)
openshift Red Hat:openshift:4.10::el7 | All versions | 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7 |
openshift-hyperkube Red Hat:openshift:4.10::el7 | All versions | 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7 |
openshift Red Hat:openshift:4.10::el8 | All versions | 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el8 |
openshift-hyperkube Red Hat:openshift:4.10::el8 | All versions | 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el8 |
openshift Red Hat:openshift:4.11::el8 | All versions | 0:4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8 |
openshift-hyperkube Red Hat:openshift:4.11::el8 | All versions | 0:4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8 |
openshift Red Hat:openshift:4.12::el8 | All versions | 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el8 |
openshift-hyperkube Red Hat:openshift:4.12::el8 | All versions | 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el8 |
openshift Red Hat:openshift:4.12::el9 | All versions | 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9 |
openshift-hyperkube Red Hat:openshift:4.12::el9 | All versions | 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9 |
Products include Kubernetes Kube-Apiserver, Redhat Openshift Container Platform.
How do I fix CVE-2023-1260?
Upgrade github.com/openshift/apiserver-library-go to 0.0.0-20230621 or later.
Is CVE-2023-1260 being exploited?
There is no known exploitation of CVE-2023-1260 in the wild and no public exploit code.
Sources
Also known as GHSA-92hx-3mh6-hc49, RHSA-2023:3976, RHSA-2023:4312, RHSA-2023:4898.