CVE-2023-2727

Description

A flaw was found in Kubernetes, where users may be able to launch containers using images restricted by the ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

Mitigation

This issue can be mitigated by applying the patch provided for the kube-apiserver component. This patch prevents ephemeral containers from using an image that is restricted by ImagePolicyWebhook.
Note: Validation webhooks, (such as Gatekeeper <https://open-policy-agent.github.io/gatekeeper-library/website/validation/allowedrepos>;
and Kyverno <https://kyverno.io/policies/other/allowed-image-repos/allowed-image-repos/>;) can also be used to enforce the same restrictions.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score6.56.56.5
Attack VectorNetworkNetworkNetwork
Attack ComplexityLowLowLow
Privileges RequiredHighHighHigh
User InteractionNoneNoneNone
ScopeUnchangedUnchangedUnchanged
ConfidentialityHighHighHigh
Integrity ImpactHighHighHigh
Availability ImpactNoneNoneNone

Vector

Red Hat: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

NVD: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

cve.org: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Acknowledgements

Upstream acknowledges Kubernetes Security Team as the original reporter.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.