kubernetes1.23-apiserver-1.23.17-4.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:13003 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z kubernetes1.23-apiserver-1.23.17-4.1 on GA media These are all security issues fixed in the kubernetes1.23-apiserver-1.23.17-4.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-13003 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:13003 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2023-2727/ SUSE CVE CVE-2023-2727 page https://www.suse.com/security/cve/CVE-2023-2728/ SUSE CVE CVE-2023-2728 page openSUSE Tumbleweed kubernetes1.23-apiserver-1.23.17-4.1 kubernetes1.23-client-1.23.17-4.1 kubernetes1.23-client-bash-completion-1.23.17-4.1 kubernetes1.23-client-common-1.23.17-4.1 kubernetes1.23-client-fish-completion-1.23.17-4.1 kubernetes1.23-controller-manager-1.23.17-4.1 kubernetes1.23-kubeadm-1.23.17-4.1 kubernetes1.23-kubelet-1.23.17-4.1 kubernetes1.23-kubelet-common-1.23.17-4.1 kubernetes1.23-proxy-1.23.17-4.1 kubernetes1.23-scheduler-1.23.17-4.1 kubernetes1.23-apiserver-1.23.17-4.1 as a component of openSUSE Tumbleweed kubernetes1.23-client-1.23.17-4.1 as a component of openSUSE Tumbleweed kubernetes1.23-client-bash-completion-1.23.17-4.1 as a component of openSUSE Tumbleweed kubernetes1.23-client-common-1.23.17-4.1 as a component of openSUSE Tumbleweed kubernetes1.23-client-fish-completion-1.23.17-4.1 as a component of openSUSE Tumbleweed kubernetes1.23-controller-manager-1.23.17-4.1 as a component of openSUSE Tumbleweed kubernetes1.23-kubeadm-1.23.17-4.1 as a component of openSUSE Tumbleweed kubernetes1.23-kubelet-1.23.17-4.1 as a component of openSUSE Tumbleweed kubernetes1.23-kubelet-common-1.23.17-4.1 as a component of openSUSE Tumbleweed kubernetes1.23-proxy-1.23.17-4.1 as a component of openSUSE Tumbleweed kubernetes1.23-scheduler-1.23.17-4.1 as a component of openSUSE Tumbleweed Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers. CVE-2023-2727 openSUSE Tumbleweed:kubernetes1.23-apiserver-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-client-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-client-bash-completion-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-client-common-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-client-fish-completion-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-controller-manager-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-kubeadm-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-kubelet-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-kubelet-common-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-proxy-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-scheduler-1.23.17-4.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-2727.html CVE-2023-2727 https://bugzilla.suse.com/1211630 SUSE Bug 1211630 Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account's secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers. CVE-2023-2728 openSUSE Tumbleweed:kubernetes1.23-apiserver-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-client-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-client-bash-completion-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-client-common-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-client-fish-completion-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-controller-manager-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-kubeadm-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-kubelet-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-kubelet-common-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-proxy-1.23.17-4.1 openSUSE Tumbleweed:kubernetes1.23-scheduler-1.23.17-4.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-2728.html CVE-2023-2728 https://bugzilla.suse.com/1211631 SUSE Bug 1211631