Veracode Vulnerability DatabaseVERACODE:46594Improper Input Validation
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
9.6%
Kubernetes is vulnerable to Improper Input Validation. The vulnerability is due to containers, init containers, and ephemeral containers with the envFrom field populated bypassing the mountable secrets policy, which ensures that pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with the mentioned containers.
References
www.openwall.com/lists/oss-security/2024/04/16/4
github.com/advisories/GHSA-pxhw-596r-rwq5
github.com/kubernetes/kubernetes/commit/7c861b1ecad97e1ab9332c970c9294a72065111a
github.com/kubernetes/kubernetes/commit/a619ca3fd3ee3c222d9df784622020de398076d2
github.com/kubernetes/kubernetes/commit/f9fb6cf52a769a599a45e700375115c2ecc86e9b
github.com/kubernetes/kubernetes/issues/124336
groups.google.com/g/kubernetes-security-announce/c/JxjHf7fkVd8/m/oVCzypyOAQAJ
lists.fedoraproject.org/archives/list/[email protected]/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/
lists.fedoraproject.org/archives/list/[email protected]/message/WL54MTLGMTBZZO5PYGEGEBERTMADC4WC/
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
9.6%