Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0872 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2021-25749:
    Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option     to true.

    CVE-2022-3172:
    A security issue was discovered in kube-apiserver that allows an     aggregated API server to redirect client traffic to any URL.  This could      lead to the client performing unexpected actions as well as forwarding     the client's API server credentials to third parties.

    CVE-2022-3294:
    Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only     affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports     node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish     connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying     address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this     validation could allow authenticated requests destined for Nodes to to the API server/'s private network.

    CVE-2023-2431:
    A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement.
    Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this     issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode.
    This bug affects Kubelet.

    CVE-2023-2728:
    Users may be able to launch containers that bypass the mountable secrets policy enforced by the     ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a     service account may only reference secrets specified in the service accounts secrets field. Kubernetes     clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-     mountable-secrets` annotation are used together with ephemeral containers.

    CVE-2023-2727:
    Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using     ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is     used together with ephemeral containers.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2292-1 advisory.

    - add kubernetes1.18-client-common as conflicts with kubernetes-client-bash-completion

    - Split individual completions into separate packages

    Update to version 1.23.17:

      * releng: Update images, dependencies and version to Go 1.19.6
      * Update golang.org/x/net to v0.7.0
      * Pin golang.org/x/net to v0.4.0
      * add scale test for probes
      * use custom dialer for http probes
      * use custom dialer for tcp probes
      * add custom dialer optimized for probes
      * egress_selector: prevent goroutines leak on connect() step.
      * tls.Dial() validates hostname, no need to do that manually
      * Fix issue that Audit Server could not correctly encode DeleteOption
      * Do not include scheduler name in the preemption event message
      * Do not leak cross namespace pod metadata in preemption events
      * pkg/controller/job: re-honor exponential backoff
      * releng: Update images, dependencies and version to Go 1.19.5
      * Bump Konnectivity to v0.0.35
      * Improve vendor verification works for each staging repo
      * Update to go1.19
      * Adjust for os/exec changes in 1.19
      * Update golangci-lint to 1.46.2 and fix errors
      * Match go1.17 defaults for SHA-1 and GC
      * update golangci-lint to 1.45.0
      * kubelet: make the image pull time more accurate in event
      * change k8s.gcr.io/pause to registry.k8s.io/pause
      * use etcd 3.5.6-0 after promotion
      * changelog: CVE-2022-3294 and CVE-2022-3162 were fixed in v1.23.14
      * Add CVE-2021-25749 to CHANGELOG-1.23.md
      * Add CVE-2022-3294 to CHANGELOG-1.23.md
      * kubeadm: use registry.k8s.io instead of k8s.gcr.io
      * etcd: Updated to v3.5.5
      * Bump konnectivity network proxy to v0.0.33. Includes a couple bug fixes for better handling of dial     failures. [Agent & Server](https://github.com/kubernetes-sigs/apiserver-network-proxy/commits/v0.0.33)     include numerous other fixes.
      * kubeadm: allow RSA and ECDSA format keys in preflight check
      * Fixes kubelet log compression on Windows
      * Reduce default gzip compression level from 4 to 1 in apiserver
      * exec auth: support TLS config caching
      * Marshal MicroTime to json and proto at the same precision
      * Windows: ensure runAsNonRoot does case-insensitive comparison on user name
      * update structured-merge-diff to 4.2.3
      * Add rate limiting when calling STS assume role API
      * Fixing issue in generatePodSandboxWindowsConfig for hostProcess containers by where pod sandbox won't     have HostProcess bit set if pod does not have a security context but containers specify HostProcess.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
239505	TencentOS Server 4: kubernetes (TSSA-2024:0872)	Nessus	Tencent Local Security Checks	Local	high
176412	SUSE SLES15 Security Update : kubernetes1.23 (SUSE-SU-2023:2292-1)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2021-25749

high

Tenable Plugins

high

high