A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.

An update of the kubernetes package has been released.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0043 advisory.

  - kubernetes: kube-apiserver: bypassing mountable secrets policy imposed by the ServiceAccount admission     plugin (CVE-2024-3177)

  - golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when     unmarshaling certain forms of invalid JSON (CVE-2024-24786)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2054 advisory.

  - kubernetes: kube-apiserver: bypassing mountable secrets policy imposed by the ServiceAccount admission     plugin (CVE-2024-3177)

  - jose-go: improper handling of highly compressed data (CVE-2024-28180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02423-2 advisory.

    - CVE-2021-25743: Escape terminal special characters in kubectl output (bsc#1194400).
    - CVE-2023-2431: Prevent pods to bypass the seccomp profile enforcement (bsc#1212493).
    - CVE-2024-0793: Advance autoscaling v2 as the preferred API version (bsc#1219964).
    - CVE-2024-3177: Prevent bypassing mountable secrets policy imposed by the ServiceAccount admission plugin     (bsc#1222539).
    - CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content     (bsc#1241865).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the     mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init     containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running     with a service account may only reference secrets specified in the service account's secrets field.
    Kubernetes clusters are only affected if the ServiceAccount admission plugin and the     kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and     ephemeral containers with the envFrom field populated. (CVE-2024-3177)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the
    mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init
    containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running
    with a service account may only reference secrets specified in the service account’s secrets field.
    Kubernetes clusters are only affected if the ServiceAccount admission plugin and the
    kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and
    ephemeral containers with the envFrom field populated. (CVE-2024-3177)

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3343-1 advisory.

    - CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized.
    (bsc#1194400)
    - CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)
    - CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1211631)
    - CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets.
    (bsc#1229869)
    - CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)
    - CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers.
    (bsc#1229869)
    - CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests.
    (bsc#1219964)
    - CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1222539)
    - CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)

    Bug fixes:

    - Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)
    - Fix multiple issues for successful `kubeadm init` run. (bsc#1214406)
    - Update go to version 1.22.5 in build requirements. (bsc#1229858)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3341-1 advisory.

    - CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized.
    (bsc#1194400)
    - CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)
    - CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1211631)
    - CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets.
    (bsc#1229869)
    - CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)
    - CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers.
    (bsc#1229869)
    - CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests.
    (bsc#1219964)
    - CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1222539)
    - CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)

    Bug fixes:

    - Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)
    - Fix multiple issues for successful `kubeadm init` run. (bsc#1214406)
    - Update go to version 1.22.5 in build requirements. (bsc#1229858)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0043 advisory.

    Red Hat build of MicroShift is Red Hat's light-weight Kubernetes orchestration solution designed for edge     device deployments and is built from the edge capabilities of Red Hat OpenShift Container Platform.
    MicroShift is an application that is deployed on top of Red Hat Enterprise Linux devices at the edge,     providing an efficient way to operate single-node clusters in these low-resource environments.

    This advisory contains the RPM packages for Red Hat build of MicroShift 4.16.0. Read the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:0041

    All Red Hat build of MicroShift 4.16 users are advised to use these updated packages and images when they     are available in the RPM repository.

    Security Fix(es):

    * golang-protobuf: encoding/protojson, internal/encoding/json: infinite     loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON     (CVE-2024-24786)
    * kubernetes: kube-apiserver: bypassing mountable secrets policy imposed by     the ServiceAccount admission plugin (CVE-2024-3177)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2054 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.14.23. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2024:2051

    Security Fix(es):

    * jose-go: improper handling of highly compressed data (CVE-2024-28180)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-ce2eefc399 advisory.

    Update Kubernetes to v1.29.4 for Fedora 40. Resolves CVE-2024-3177: Bypassing mountable secrets policy     imposed by the ServiceAccount admission plugin.

    Additional bug and regression fixes include a bump to Golang.org/x/net to v0.23.0 to address     CVE-2023-45288 .

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-662a8b6005 advisory.

    Updates Fedora 30 to Kubernetes 1.27.13.
    Resolves CVE-2024-3177: Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin.
    In addition, a few bug and regression fixes.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1403-1 advisory.

    - CVE-2024-3177: Fixed bypass of mountable secrets policy imposed by the ServiceAccount admission plugin     (bsc#1222539)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1404-1 advisory.

    - CVE-2024-3177: Fixed bypass of mountable secrets policy imposed by the ServiceAccount admission plugin     (bsc#1222539)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
332301	Photon OS 5.0: Kubernetes PHSA-2024-5.0-91-0255	Nessus	PhotonOS Local Security Checks	Local	low
312058	RHCOS 4 : Red Hat build of MicroShift 4.16.0 (RHSA-2024:0043)	Nessus	Red Hat Local Security Checks	Local	high
311925	RHCOS 4 : OpenShift Container Platform 4.14.23 (RHSA-2024:2054)	Nessus	Red Hat Local Security Checks	Local	low
278691	SUSE SLES15 Security Update : kubernetes1.23 (SUSE-SU-2025:02423-2)	Nessus	SuSE Local Security Checks	Local	medium
258645	Linux Distros Unpatched Vulnerability : CVE-2024-3177	Nessus	Misc.	Local	low
417775	SCA: security update for k8s.io/kubernetes (GHSA-pxhw-596r-rwq5)	Tenable Cloud Security	SCA Checks	Local	low
417775	SCA: security update for k8s.io/kubernetes (GHSA-pxhw-596r-rwq5)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
207490	SUSE SLES15 Security Update : kubernetes1.24 (SUSE-SU-2024:3343-1)	Nessus	SuSE Local Security Checks	Local	critical
207488	SUSE SLES15 Security Update : kubernetes1.23 (SUSE-SU-2024:3341-1)	Nessus	SuSE Local Security Checks	Local	critical
204158	Photon OS 4.0: Kubernetes PHSA-2024-4.0-0598	Nessus	PhotonOS Local Security Checks	Local	low
204141	Photon OS 5.0: Kubernetes PHSA-2024-5.0-0255	Nessus	PhotonOS Local Security Checks	Local	low
201095	RHEL 9 : Red Hat build of MicroShift 4.16.0 (RHSA-2024:0043)	Nessus	Red Hat Local Security Checks	Local	low
194947	RHEL 8 / 9 : OpenShift Container Platform 4.14.23 (RHSA-2024:2054)	Nessus	Red Hat Local Security Checks	Local	low
194505	Fedora 40 : kubernetes (2024-ce2eefc399)	Nessus	Fedora Local Security Checks	Local	low
193862	Fedora 39 : kubernetes (2024-662a8b6005)	Nessus	Fedora Local Security Checks	Local	low
193807	SUSE SLES15: kubernetes1.24-apiserver / kubernetes1.24-client / etc (SUSE-SU-2024:1403-1)	Nessus	SuSE Local Security Checks	Local	low
193766	SUSE SLES15: kubernetes1.23-apiserver / kubernetes1.23-client / etc (SUSE-SU-2024:1404-1)	Nessus	SuSE Local Security Checks	Local	low

Detections

Analytics

CVE-2024-3177

low

Tenable Plugins

low

high

low

medium

low

low

low

critical

critical

low

low

low

low

low

low

low

low