Описание
Security update for kubernetes1.23
This update for kubernetes1.23 fixes the following issues:
- CVE-2021-25743: Escape terminal special characters in kubectl output (bsc#1194400).
- CVE-2023-2431: Prevent pods to bypass the seccomp profile enforcement (bsc#1212493).
- CVE-2024-0793: Advance autoscaling v2 as the preferred API version (bsc#1219964).
- CVE-2024-3177: Prevent bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (bsc#1222539).
- CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content (bsc#1241865).
Список пакетов
SUSE Enterprise Storage 7.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP3-LTSS
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP3
SUSE Linux Enterprise Server for SAP Applications 15 SP4
Ссылки
- Link for SUSE-SU-2025:02423-2
- E-Mail link for SUSE-SU-2025:02423-2
- SUSE Security Ratings
- SUSE Bug 1194400
- SUSE Bug 1212493
- SUSE Bug 1219964
- SUSE Bug 1222539
- SUSE Bug 1229008
- SUSE Bug 1241865
- SUSE CVE CVE-2021-25743 page
- SUSE CVE CVE-2023-2431 page
- SUSE CVE CVE-2024-0793 page
- SUSE CVE CVE-2024-3177 page
- SUSE CVE CVE-2025-22872 page
Описание
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
Затронутые продукты
Ссылки
- CVE-2021-25743
- SUSE Bug 1194400
Описание
A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.
Затронутые продукты
Ссылки
- CVE-2023-2431
- SUSE Bug 1212493
Описание
A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.
Затронутые продукты
Ссылки
- CVE-2024-0793
- SUSE Bug 1219964
Описание
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account's secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
Затронутые продукты
Ссылки
- CVE-2024-3177
- SUSE Bug 1222539
Описание
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).
Затронутые продукты
Ссылки
- CVE-2025-22872
- SUSE Bug 1241710