A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader access to the cluster.

A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader access to the cluster.

dns: Denial of Service (DoS) osin: manipulation of the argument secret leads to observable timing discrepancy mongo-go-driver: specific cstrings input may not be properly validated cortex: Grafana Cortex directory traversal go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents helm: Denial of service through through repository index file helm: Denial of service through schema file golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding go-getter: go-getter vulnerable to denial of service via malicious compressed archive vault: Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File hashicorp/vault: Vault’s PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata openshift: OCP & FIPS mode golang.org/x/net/html: Cross site scripting OpenShift: modification of node role labels hashicorp/vault: Cache-Timing Attacks During Seal and Unseal Operations helm: getHostByName Function Information Disclosure containerd: Supplementary groups are not set up properly word-wrap: ReDoS tough-cookie: prototype pollution in cookie memstore runc: volume mount race condition (regression of CVE-2019-19921) golang-github-gin-gonic-gin: Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment function goproxy: Denial of service (DoS) via unspecified vectors. golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)…

Ein lokaler Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um seine Privilegien zu erhöhen.