CVE-2024-3177
Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin in k8s.io/kubernetes
描述
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
如何修補 CVE-2024-3177
要修補 CVE-2024-3177,請將受影響套件升級到下列已修補版本。
- —升級至 1.20.5+really1.20.2-1 或更新版本
- —升級至 1.27.13 或更新版本
- —升級至 1.27.13 或更新版本
CVE-2024-3177 正在被利用嗎?
低 — EPSS 為 2.2%,目前沒有觀察到大規模利用活動。
受影響套件(3)
- from 0, < 1.20.5+really1.20.2-1
- from 0, < 1.27.13
- from 0, < 1.27.13, >= 1.28.0, < 1.28.9, >= 1.29.0, < 1.29.4
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | LOW2.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |