chore(deps): update module k8s.io/kubernetes to v1.32.4 [security] (release-v0.19)

[redhat-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
k8s.io/kubernetes	require	minor	v1.15.0-alpha.0 -> v1.32.4

---

Server Side Request Forgery (SSRF) in Kubernetes

CVE-2020-8555 / GHSA-x6mj-w4jf-jmgw / GO-2022-0890

More information

Details

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-8555
• https://github.com/kubernetes/kubernetes/issues/91542
• https://github.com/kubernetes/kubernetes/pull/89794
• https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion
• https://lists.fedoraproject.org/archives/list/[email protected]/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX
• https://security.netapp.com/advisory/ntap-20200724-0005
• http://www.openwall.com/lists/oss-security/2020/06/01/4
• http://www.openwall.com/lists/oss-security/2021/05/04/8

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Server Side Request Forgery (SSRF) in Kubernetes in k8s.io/kubernetes

CVE-2020-8555 / GHSA-x6mj-w4jf-jmgw / GO-2022-0890

More information

Details

Server Side Request Forgery (SSRF) in Kubernetes in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-x6mj-w4jf-jmgw
• https://nvd.nist.gov/vuln/detail/CVE-2020-8555
• http://www.openwall.com/lists/oss-security/2020/06/01/4
• http://www.openwall.com/lists/oss-security/2021/05/04/8
• https://github.com/kubernetes/kubernetes/issues/91542
• https://github.com/kubernetes/kubernetes/pull/89794
• https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion
• https://lists.fedoraproject.org/archives/list/[email protected]/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX
• https://security.netapp.com/advisory/ntap-20200724-0005

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Kubernetes client-go library logs may disclose credentials to unauthorized users

CVE-2019-11250 / GHSA-jmrx-5g74-6v2f / GO-2021-0065

More information

Details

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2019-11250
• https://github.com/kubernetes/kubernetes/issues/81114
• https://github.com/kubernetes/kubernetes/pull/81330
• https://github.com/kubernetes/kubernetes/commit/4441f1d9c3e94d9a3d93b4f184a591cab02a5245
• https://access.redhat.com/errata/RHSA-2019:4052
• https://access.redhat.com/errata/RHSA-2019:4087
• https://github.com/kubernetes/kubernetes
• https://pkg.go.dev/vuln/GO-2021-0065
• https://security.netapp.com/advisory/ntap-20190919-0003
• http://www.openwall.com/lists/oss-security/2020/10/16/2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Improper Authentication in Kubernetes in k8s.io/kubernetes

CVE-2020-8558 / GHSA-wqv3-8cm6-h6wg / GO-2022-0885

More information

Details

Improper Authentication in Kubernetes in k8s.io/kubernetes

Severity

Unknown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8558
• https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-wqv3-8cm6-h6wg
• https://nvd.nist.gov/vuln/detail/CVE-2020-8558
• https://bugzilla.redhat.com/show_bug.cgi?id=1843358
• https://github.com/kubernetes/kubernetes/issues/92315
• https://github.com/tabbysable/POC-2020-8558
• https://groups.google.com/g/kubernetes-announce/c/sI4KmlH3S2I/m/TljjxOBvBQAJ
• https://groups.google.com/g/kubernetes-security-announce/c/B1VegbBDMTE
• https://labs.bishopfox.com/tech-blog/bad-pods-kubernetes-pod-privilege-escalation
• https://security.netapp.com/advisory/ntap-20200821-0001
• https://www.openwall.com/lists/oss-security/2020/07/08/1

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Improper Authentication in Kubernetes

CVE-2020-8558 / GHSA-wqv3-8cm6-h6wg / GO-2022-0885

More information

Details

A security issue was discovered in the Kubelet and kube-proxy components of Kubernetes which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. For example, if a cluster administrator runs a TCP service on a node that listens on 127.0.0.1:1234, because of this bug, that service would be potentially reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service. If the example service on port 1234 required no additional authentication (because it assumed that only other localhost processes could reach it), then it could be vulnerable to attacks that make use of this bug.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-wqv3-8cm6-h6wg
• https://nvd.nist.gov/vuln/detail/CVE-2020-8558
• https://github.com/kubernetes/kubernetes/issues/92315
• https://bugzilla.redhat.com/show_bug.cgi?id=1843358
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8558
• https://github.com/kubernetes/kubernetes
• https://github.com/tabbysable/POC-2020-8558
• https://groups.google.com/g/kubernetes-announce/c/sI4KmlH3S2I/m/TljjxOBvBQAJ
• https://groups.google.com/g/kubernetes-security-announce/c/B1VegbBDMTE
• https://labs.bishopfox.com/tech-blog/bad-pods-kubernetes-pod-privilege-escalation
• https://security.netapp.com/advisory/ntap-20200821-0001
• https://www.openwall.com/lists/oss-security/2020/07/08/1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Denial of service in Kubernetes in k8s.io/kubernetes

CVE-2020-8557 / GHSA-55qj-gj3x-jq9r / GO-2024-2753

More information

Details

Denial of service in Kubernetes in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-55qj-gj3x-jq9r
• https://nvd.nist.gov/vuln/detail/CVE-2020-8557
• https://github.com/kubernetes/kubernetes/commit/530f199b6e07cdaab32361e39709ac45f3fdc446
• https://github.com/kubernetes/kubernetes/commit/68750fefd3df76b7b008ef7b18e8acd18d5c2f2e
• https://github.com/kubernetes/kubernetes/commit/7fd849cffa2f93061fbcb0a6ae4efd0539b1e981
• https://github.com/kubernetes/kubernetes/issues/93032
• https://github.com/kubernetes/kubernetes/pull/92921
• https://groups.google.com/g/kubernetes-security-announce/c/cB_JUsYEKyY/m/vVSO61AhBwAJ
• https://security.netapp.com/advisory/ntap-20200821-0002

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Privilege Escalation in Kubernetes

CGA-j37w-9p7g-v3pm / CVE-2020-8559 / GHSA-33c5-9fx5-fvjm / GO-2024-2748

More information

Details

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.7 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-8559
• https://github.com/kubernetes/kubernetes/issues/92914
• https://github.com/kubernetes/kubernetes/pull/92941
• https://bugzilla.redhat.com/show_bug.cgi?id=1851422
• https://github.com/kubernetes/kubernetes
• https://github.com/tdwyer/CVE-2020-8559
• https://groups.google.com/d/msg/kubernetes-security-announce/JAIGG5yNROs/19nHQ5wkBwAJ
• https://groups.google.com/g/kubernetes-security-announce/c/JAIGG5yNROs
• https://security.netapp.com/advisory/ntap-20200810-0004

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Privilege Escalation in Kubernetes in k8s.io/apimachinery

CGA-j37w-9p7g-v3pm / CVE-2020-8559 / GHSA-33c5-9fx5-fvjm / GO-2024-2748

More information

Details

The Kubernetes kube-apiserver is vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

Severity

Unknown

References

• https://github.com/advisories/GHSA-33c5-9fx5-fvjm
• https://bugzilla.redhat.com/show_bug.cgi?id=1851422
• https://github.com/kubernetes/kubernetes/issues/92914
• https://github.com/kubernetes/kubernetes/pull/92941
• https://github.com/tdwyer/CVE-2020-8559
• https://groups.google.com/d/msg/kubernetes-security-announce/JAIGG5yNROs/19nHQ5wkBwAJ
• https://groups.google.com/g/kubernetes-security-announce/c/JAIGG5yNROs
• https://security.netapp.com/advisory/ntap-20200810-0004

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Sensitive Information leak via Log File in Kubernetes in k8s.io/kubernetes

CVE-2020-8566 / GHSA-5x96-j797-5qqw / GO-2024-2754

More information

Details

Sensitive Information leak via Log File in Kubernetes in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-5x96-j797-5qqw
• https://nvd.nist.gov/vuln/detail/CVE-2020-8566
• https://bugzilla.redhat.com/show_bug.cgi?id=1886640
• https://github.com/kubernetes/kubernetes/issues/95624
• https://github.com/kubernetes/kubernetes/pull/95245
• https://github.com/kubernetes/kubernetes/pull/95245/commits/e91ec4fad3366d2dee020919f7c2a0d7b52fd3ea
• https://groups.google.com/g/kubernetes-announce/c/ScdmyORnPDk
• https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ
• https://security.netapp.com/advisory/ntap-20210122-0006

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Access Restriction Bypass in kube-apiserver

CVE-2021-25735 / GHSA-g42g-737j-qx6j / GO-2022-0907

More information

Details

A vulnerability in Kubernetes kube-apiserver could allow node updates to bypass a Validating Admission Webhook and allow unauthorized node updates. The information that is provided to the admission controller could contain old configurations that overwrite values used for validation. Since the overwriting takes place before the validation, this could lead the admission controller to accept requests that should be blocked. The vulnerability can be exploited when an update action on node resources is performed and an admission controller is in place and configured to validate the action.

Users are only affected by this vulnerability if they are running a Validating Admission Webhook for Nodes that denies admission based partially on the old state of the Node object. It only impacts validating admission plugins that rely on old values in certain fields and does not impact calls from kubelets that go through the built-in NodeRestriction admission plugin.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-25735
• https://github.com/kubernetes/kubernetes/issues/100096
• https://github.com/kubernetes/kubernetes/pull/99946
• https://github.com/kubernetes/kubernetes/commit/00e81db174ef7aca497be5f42d87e46d14df2a90
• https://bugzilla.redhat.com/show_bug.cgi?id=1937562
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y
• https://pkg.go.dev/k8s.io/[email protected]/cmd/kube-apiserver
• https://sysdig.com/blog/cve-2021-25735-kubernetes-admission-bypass

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Access Restriction Bypass in kube-apiserver in k8s.io/kubernetes

CVE-2021-25735 / GHSA-g42g-737j-qx6j / GO-2022-0907

More information

Details

Access Restriction Bypass in kube-apiserver in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-g42g-737j-qx6j
• https://nvd.nist.gov/vuln/detail/CVE-2021-25735
• https://bugzilla.redhat.com/show_bug.cgi?id=1937562
• https://github.com/kubernetes/kubernetes/commit/00e81db174ef7aca497be5f42d87e46d14df2a90
• https://github.com/kubernetes/kubernetes/issues/100096
• https://github.com/kubernetes/kubernetes/pull/99946
• https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y
• https://pkg.go.dev/k8s.io/[email protected]/cmd/kube-apiserver
• https://sysdig.com/blog/cve-2021-25735-kubernetes-admission-bypass

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Potential proxy IP restriction bypass in Kubernetes

CVE-2020-8562 / GHSA-qh36-44jv-c8xj

More information

Details

As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. All versions of Kubernetes are impacted, and there is no fix in place.

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-8562
• https://github.com/kubernetes/kubernetes/issues/101493
• https://github.com/kubernetes/kubernetes/issues/101493#issuecomment-2272095629
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/-MFX60_wdOY
• https://security.netapp.com/advisory/ntap-20220225-0002

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Sensitive Information leak via Log File in Kubernetes in k8s.io/kubernetes

CVE-2020-8563 / GHSA-5xfg-wv98-264m / GO-2024-2755

More information

Details

Sensitive Information leak via Log File in Kubernetes in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-5xfg-wv98-264m
• https://nvd.nist.gov/vuln/detail/CVE-2020-8563
• https://bugzilla.redhat.com/show_bug.cgi?id=1886635
• https://github.com/kubernetes/kubernetes/issues/95621
• https://github.com/kubernetes/kubernetes/pull/95236
• https://github.com/kubernetes/kubernetes/pull/95236/commits/247f6dd09299bc7893c1e0affea11c0255025b96
• https://groups.google.com/g/kubernetes-announce/c/ScdmyORnPDk
• https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ
• https://security.netapp.com/advisory/ntap-20210122-0006

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Files or Directories Accessible to External Parties in kubernetes in k8s.io/kubernetes

CVE-2021-25741 / GHSA-f5f7-6478-qm6p / GO-2022-0910

More information

Details

Files or Directories Accessible to External Parties in kubernetes in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-f5f7-6478-qm6p
• https://nvd.nist.gov/vuln/detail/CVE-2021-25741
• https://github.com/kubernetes/kubernetes/issues/104980
• https://groups.google.com/g/kubernetes-security-announce/c/nyfdhK24H7s
• https://security.netapp.com/advisory/ntap-20211008-0006

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Files or Directories Accessible to External Parties in kubernetes

CVE-2021-25741 / GHSA-f5f7-6478-qm6p / GO-2022-0910

More information

Details

A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-f5f7-6478-qm6p
• https://nvd.nist.gov/vuln/detail/CVE-2021-25741
• https://github.com/kubernetes/kubernetes/issues/104980
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/nyfdhK24H7s
• https://security.netapp.com/advisory/ntap-20211008-0006

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Sensitive information leak via log file in k8s.io/kubernetes

CVE-2020-8564 / GHSA-8mjg-8c8g-6h85 / GO-2021-0066

More information

Details

Attempting to read a malformed .dockercfg may cause secrets to be inappropriately logged.

Severity

Unknown

References

• https://github.com/kubernetes/kubernetes/pull/94712
• https://github.com/kubernetes/kubernetes/commit/11793434dac97a49bfed0150b56ac63e5dc34634
• https://github.com/kubernetes/kubernetes/issues/95622

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Kubernetes Sensitive Information leak via Log File

CVE-2020-8564 / GHSA-8mjg-8c8g-6h85 / GO-2021-0066

More information

Details

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Severity

• CVSS Score: 4.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-8564
• https://github.com/kubernetes/kubernetes/issues/95622
• https://github.com/kubernetes/kubernetes/pull/94712
• https://github.com/kubernetes/kubernetes/commit/11793434dac97a49bfed0150b56ac63e5dc34634
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ
• https://pkg.go.dev/vuln/GO-2021-0066
• https://security.netapp.com/advisory/ntap-20210122-0006

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Kubernetes client-go vulnerable to Sensitive Information Leak via Log File

CVE-2020-8565 / GHSA-8cfg-vx93-jvxw / GO-2021-0064

More information

Details

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.5, <= v1.18.13, <= v1.17.15, < v1.20.0-alpha2.

Severity

• CVSS Score: 4.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-8565
• https://github.com/kubernetes/kubernetes/issues/95623
• https://github.com/kubernetes/kubernetes/pull/95316
• https://github.com/kubernetes/client-go/commit/19875a3d5a2e0d4f51c976a9e0662de3c2c011e3
• https://github.com/kubernetes/client-go/commit/1b8383fc150c9b816b0072032cca75754c2734d0
• https://github.com/kubernetes/client-go/commit/44e1a07f2d513e375c4b6ee6e890040b47befe86
• https://github.com/kubernetes/client-go/commit/e8f871a2e5fadf90fc114565abc0963967f1a373
• https://github.com/kubernetes/kubernetes/commit/e99df0e5a75eb6e86123b56d53e9b7ca0fd00419
• https://github.com/kubernetes/client-go
• https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ
• https://pkg.go.dev/vuln/GO-2021-0064

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Kube-proxy may unintentionally forward traffic in k8s.io/kubernetes

CVE-2021-25736 / GHSA-35c7-w35f-xwgh / GO-2023-2159

More information

Details

Kube-proxy may unintentionally forward traffic in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-35c7-w35f-xwgh
• https://nvd.nist.gov/vuln/detail/CVE-2021-25736
• https://github.com/kubernetes/kubernetes/commit/b014610de3e5cf1bb0f7844b5758d29fc18b75e6
• https://github.com/kubernetes/kubernetes/pull/99958
• https://groups.google.com/g/kubernetes-security-announce/c/lIoOPObO51Q/m/O15LOazPAgAJ

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Unverified Ownership in Kubernetes

CVE-2020-8554 / GHSA-j9wf-vvm6-4r9w

More information

Details

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.

Severity

• CVSS Score: 5.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-8554
• https://github.com/kubernetes/kubernetes/issues/97076
• https://github.com/kubernetes/kubernetes/issues/97110
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/iZWsF9nbKE8
• https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef822b3bb3@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b6@​%3Ccommits.druid.apache.org%3E
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Confused Deputy in Kubernetes

CVE-2020-8561 / GHSA-74j8-88mm-7496

More information

Details

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

Severity

• CVSS Score: 4.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-8561
• https://github.com/kubernetes/kubernetes/issues/104720
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/RV2IhwcrQsY
• https://security.netapp.com/advisory/ntap-20211014-0002

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Confused Deputy in Kubernetes

CVE-2021-25740 / GHSA-vw47-mr44-3jf9

More information

Details

A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-25740
• https://github.com/kubernetes/kubernetes/issues/103675
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/WYE9ptrhSLE
• https://security.netapp.com/advisory/ntap-20211014-0001

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Kubelet vulnerable to bypass of seccomp profile enforcement

CVE-2023-2431 / GHSA-xc8m-28vv-4pjc / GO-2023-1864

More information

Details

A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.

Severity

• CVSS Score: 4.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-2431
• https://github.com/kubernetes/kubernetes/issues/118690
• https://github.com/kubernetes/kubernetes/pull/117020
• https://github.com/kubernetes/kubernetes/pull/117116
• https://github.com/kubernetes/kubernetes/pull/117117
• https://github.com/kubernetes/kubernetes/pull/117118
• https://github.com/kubernetes/kubernetes/pull/117147
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/QHmx0HOQa10
• https://lists.fedoraproject.org/archives/list/[email protected]/message/43HDSKBKPSW53OW647B5ETHRWFFNHSRQ
• https://lists.fedoraproject.org/archives/list/[email protected]/message/XBX4RL4UOC7JHWWYB2AJCKSUM7EG5Y5G
• https://pkg.go.dev/vuln/GO-2023-1864

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Kubelet vulnerable to bypass of seccomp profile enforcement in k8s.io/kubernetes

CVE-2023-2431 / GHSA-xc8m-28vv-4pjc / GO-2023-1864

More information

Details

Kubelet vulnerable to bypass of seccomp profile enforcement in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-xc8m-28vv-4pjc
• https://nvd.nist.gov/vuln/detail/CVE-2023-2431
• https://github.com/kubernetes/kubernetes/issues/118690
• https://github.com/kubernetes/kubernetes/pull/117020
• https://github.com/kubernetes/kubernetes/pull/117116
• https://github.com/kubernetes/kubernetes/pull/117117
• https://github.com/kubernetes/kubernetes/pull/117118
• https://github.com/kubernetes/kubernetes/pull/117147
• https://groups.google.com/g/kubernetes-security-announce/c/QHmx0HOQa10
• https://lists.fedoraproject.org/archives/list/[email protected]/message/43HDSKBKPSW53OW647B5ETHRWFFNHSRQ
• https://lists.fedoraproject.org/archives/list/[email protected]/message/XBX4RL4UOC7JHWWYB2AJCKSUM7EG5Y5G

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Kubernetes mountable secrets policy bypass

CVE-2023-2728 / GHSA-cgcv-5272-97pr / GO-2023-1892

More information

Details

Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with ephemeral containers.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-2728
• https://github.com/kubernetes/kubernetes/issues/118640
• https://github.com/kubernetes/kubernetes/pull/118356
• https://github.com/kubernetes/kubernetes/pull/118471
• https://github.com/kubernetes/kubernetes/pull/118473
• https://github.com/kubernetes/kubernetes/pull/118474
• https://github.com/kubernetes/kubernetes/pull/118512
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8
• https://security.netapp.com/advisory/ntap-20230803-0004
• http://www.openwall.com/lists/oss-security/2023/07/06/3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Kubernetes mountable secrets policy bypass in k8s.io/kubernetes

CVE-2023-2728 / GHSA-cgcv-5272-97pr / GO-2023-1892

More information

Details

Kubernetes mountable secrets policy bypass in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-cgcv-5272-97pr
• https://nvd.nist.gov/vuln/detail/CVE-2023-2728
• http://www.openwall.com/lists/oss-security/2023/07/06/3
• https://github.com/kubernetes/kubernetes/issues/118640
• https://github.com/kubernetes/kubernetes/pull/118356
• https://github.com/kubernetes/kubernetes/pull/118471
• https://github.com/kubernetes/kubernetes/pull/118473
• https://github.com/kubernetes/kubernetes/pull/118474
• https://github.com/kubernetes/kubernetes/pull/118512
• https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

kube-apiserver vulnerable to policy bypass

CVE-2023-2727 / GHSA-qc2g-gmh6-95p4 / GO-2023-1891

More information

Details

Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-2727
• https://github.com/kubernetes/kubernetes/issues/118640
• https://github.com/kubernetes/kubernetes/pull/118356
• https://github.com/kubernetes/kubernetes/pull/118471
• https://github.com/kubernetes/kubernetes/pull/118473
• https://github.com/kubernetes/kubernetes/pull/118474
• https://github.com/kubernetes/kubernetes/pull/118512
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8
• https://security.netapp.com/advisory/ntap-20230803-0004
• http://www.openwall.com/lists/oss-security/2023/07/06/2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

kube-apiserver vulnerable to policy bypass in k8s.io/kubernetes

CVE-2023-2727 / GHSA-qc2g-gmh6-95p4 / GO-2023-1891

More information

Details

kube-apiserver vulnerable to policy bypass in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-qc2g-gmh6-95p4
• https://nvd.nist.gov/vuln/detail/CVE-2023-2727
• http://www.openwall.com/lists/oss-security/2023/07/06/2
• https://github.com/kubernetes/kubernetes/issues/118640
• https://github.com/kubernetes/kubernetes/pull/118356
• https://github.com/kubernetes/kubernetes/pull/118471
• https://github.com/kubernetes/kubernetes/pull/118473
• https://github.com/kubernetes/kubernetes/pull/118474
• https://github.com/kubernetes/kubernetes/pull/118512
• https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes

CVE-2023-3676 / GHSA-7fxm-f474-hf8w / GO-2023-2330

More information

Details

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

Severity

Unknown

References

• https://github.com/advisories/GHSA-7fxm-f474-hf8w
• https://github.com/kubernetes/kubernetes/commit/073f9ea33a93ddaecdc2e829150fb715f6387399
• https://github.com/kubernetes/kubernetes/commit/39cc101c7855341c651a943b9836b50fbace8a6b
• https://github.com/kubernetes/kubernetes/commit/74b617310c24ca84c2ec90c3858af745d65b5226
• https://github.com/kubernetes/kubernetes/commit/890483394221c8f22e88c48f86cd4eaf4de65fd6
• https://github.com/kubernetes/kubernetes/commit/a53faf5e17ed0b0771a605c6401ba4cbf297b59a
• [https://gith

[redhat-renovate-bot]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -d -t ./...
go: -d flag is deprecated. -d=true is a no-op
go: downloading github.com/machadovilaca/operator-observability v0.0.18
go: downloading sigs.k8s.io/controller-runtime v0.16.3
go: downloading k8s.io/api v0.28.4
go: downloading github.com/kubevirt/monitoring/pkg/metrics/parser v0.0.0-20230710120526-cc1644c90b64
go: downloading github.com/container-storage-interface/spec v1.9.0
go: downloading k8s.io/apimachinery v0.28.4
go: downloading k8s.io/klog/v2 v2.130.1
go: downloading golang.org/x/sys v0.29.0
go: downloading github.com/kubernetes-csi/csi-lib-utils v0.16.0
go: downloading github.com/golang/protobuf v1.5.4
go: downloading github.com/prometheus/client_golang v1.19.1
go: downloading golang.org/x/net v0.34.0
go: downloading k8s.io/client-go v0.28.3
go: downloading github.com/kubernetes-csi/csi-test/v4 v4.4.0
go: downloading github.com/prometheus/client_model v0.6.1
go: downloading github.com/onsi/gomega v1.10.1
go: downloading k8s.io/apiextensions-apiserver v0.28.4
go: downloading kubevirt.io/hostpath-provisioner-operator v0.18.0
go: downloading golang.org/x/time v0.7.0
go: downloading google.golang.org/grpc v1.65.0
go: downloading github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.71.2
go: downloading k8s.io/kubernetes v1.32.4
go: downloading k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
go: downloading sigs.k8s.io/sig-storage-lib-external-provisioner/v6 v6.3.0
go: downloading github.com/go-logr/logr v1.4.2
go: downloading google.golang.org/protobuf v1.35.1
go: downloading github.com/google/uuid v1.6.0
go: downloading github.com/onsi/ginkgo v1.12.1
go: downloading gopkg.in/yaml.v2 v2.4.0
go: downloading github.com/prometheus/common v0.55.0
go: downloading github.com/gogo/protobuf v1.3.2
go: downloading gopkg.in/inf.v0 v0.9.1
go: downloading github.com/google/gofuzz v1.2.0
go: downloading sigs.k8s.io/structured-merge-diff/v4 v4.4.2
go: downloading github.com/openshift/custom-resource-status v1.1.2
go: downloading k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20240826202546-f6391c0de4c7
go: downloading github.com/miekg/dns v1.1.29
go: downloading github.com/beorn7/perks v1.0.1
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/prometheus/procfs v0.15.1
go: downloading github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da
go: downloading golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2
go: downloading github.com/imdario/mergo v0.3.12
go: downloading github.com/spf13/pflag v1.0.5
go: downloading golang.org/x/term v0.28.0
go: downloading github.com/google/gnostic-models v0.6.8
go: downloading sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3
go: downloading gomodules.xyz/jsonpatch/v2 v2.4.0
go: downloading github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822
go: downloading golang.org/x/crypto v0.32.0
go: downloading github.com/json-iterator/go v1.1.12
go: downloading sigs.k8s.io/yaml v1.4.0
go: downloading golang.org/x/oauth2 v0.23.0
go: downloading github.com/google/go-cmp v0.6.0
go: downloading golang.org/x/text v0.21.0
go: downloading github.com/fsnotify/fsnotify v1.7.0
go: downloading github.com/nxadm/tail v1.4.8
go: downloading github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading github.com/modern-go/reflect2 v1.0.2
go: downloading github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
go: downloading github.com/evanphx/json-patch/v5 v5.6.0
go: downloading k8s.io/component-base v0.28.4
go: downloading golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
go: downloading gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7
go: downloading github.com/emicklei/go-restful/v3 v3.11.0
go: downloading github.com/go-openapi/jsonreference v0.20.2
go: downloading github.com/go-openapi/swag v0.23.0
go: downloading github.com/pkg/errors v0.9.1
go: downloading github.com/go-openapi/jsonpointer v0.21.0
go: downloading github.com/mailru/easyjson v0.7.7
go: downloading github.com/josharian/intern v1.0.0
go: downloading k8s.io/apiserver v0.28.4
go: downloading k8s.io/controller-manager v0.0.0
go: downloading github.com/blang/semver/v4 v4.0.0
go: downloading k8s.io/mount-utils v0.0.0
go: downloading github.com/blang/semver v3.5.1+incompatible
go: downloading k8s.io/component-base v0.33.0
go: k8s.io/[email protected] requires go >= 1.24.0 (running go 1.23.6)

[kubevirt-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign awels for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kubevirt-bot]

@redhat-renovate-bot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-hostpath-provisioner-sanity	af04d47	link	true	/test pull-hostpath-provisioner-sanity
pull-hpp-unit-test	af04d47	link	false	/test pull-hpp-unit-test
pull-hostpath-provisioner-e2e-k8s	af04d47	link	true	/test pull-hostpath-provisioner-e2e-k8s
pull-hostpath-provisioner-k8s-e2e-storage	af04d47	link	true	/test pull-hostpath-provisioner-k8s-e2e-storage
pull-hostpath-provisioner-e2e-k8s-ceph	af04d47	link	true	/test pull-hostpath-provisioner-e2e-k8s-ceph

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.