Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

SUSE: 2024:3343-1 important: kubernetes1.24 resource consumption issue

suse
Calendar Grey September 19, 2024
Dist Suse Esm H88
Critical security patch for kubernetes 1.24 on SUSE; addresses various vulnerabilities. Update now for improved system safety.
* bsc#1062303 * bsc#1194400 * bsc#1211630 * bsc#1211631 * bsc#1214406

Summary

## This update for kubernetes1.24 fixes the following issues: * CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized. (bsc#1194400) * CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630) * CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1211631) * CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets. (bsc#1229869) * CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869) * CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers. (bsc#1229869)

Topics%20covered

Topics Covered

security advisory SUSE bug fixes important update resource consumption kubernetes policy bypass

References

* bsc#1062303

* bsc#1194400

* bsc#1211630

* bsc#1211631

* bsc#1214406

* bsc#1216109

* bsc#1216123

* bsc#1219964

* bsc#1221400

* bsc#1222539

* bsc#1226136

* bsc#1229858

* bsc#1229867

* bsc#1229869

* bsc#1230323

Cross-

* CVE-2021-25743

* CVE-2023-2727

* CVE-2023-2728

* CVE-2023-39325

* CVE-2023-44487

* CVE-2023-45288

* CVE-2024-0793

* CVE-2024-24786

* CVE-2024-3177

CVSS scores:

* CVE-2021-25743 ( SUSE ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

* CVE-2021-25743 ( NVD ): 3.0 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

* CVE-2023-2727 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

* CVE-2023-2727 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

* CVE-2023-2728 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2024:3343-1
Rating: important

Topics%20covered

Topics Covered

security advisory SUSE bug fixes important update resource consumption kubernetes policy bypass

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here