Go/k8s.io/kubernetes CVE-2023-2727: unknown, EPSS 1.13%
Vulnerable to policy bypass in kube-apiserver in k8s.io/kubernetes
Action: Upgrade k8s.io/kubernetes to 1.24.15 or later.
go get k8s.io/kubernetes@v1.24.15go get k8s.io/kubernetes@v1.25.11go get k8s.io/kubernetes@v1.26.6go get k8s.io/kubernetes@v1.27.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.24.15 | - |
| 1.25.0 | 1.25.11 | - |
| 1.26.0 | 1.26.6 | - |
| 1.27.0 | 1.27.3 | - |
Fixed versions
| 1.24.15 | 1.25.11 | 1.26.6 | 1.27.3 |
Sources
- osv: GO-2023-1891
- https://github.com/advisories/GHSA-qc2g-gmh6-95p4
- http://www.openwall.com/lists/oss-security/2023/07/06/2
- https://github.com/kubernetes/kubernetes/issues/118640
- https://github.com/kubernetes/kubernetes/pull/118356
- https://github.com/kubernetes/kubernetes/pull/118471
- https://github.com/kubernetes/kubernetes/pull/118473
- https://github.com/kubernetes/kubernetes/pull/118474
- https://github.com/kubernetes/kubernetes/pull/118512
- https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8
CVE-2023-2727 · published · modified · JSON