Security update for kubernetes1.23 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:02423-1 Final 1 1 2025-07-21T08:36:40Z current 2025-07-21T08:36:40Z 2025-07-21T08:36:40Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for kubernetes1.23 This update for kubernetes1.23 fixes the following issues: - CVE-2021-25743: Escape terminal special characters in kubectl output (bsc#1194400). - CVE-2023-2431: Prevent pods to bypass the seccomp profile enforcement (bsc#1212493). - CVE-2024-0793: Advance autoscaling v2 as the preferred API version (bsc#1219964). - CVE-2024-3177: Prevent bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (bsc#1222539). - CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content (bsc#1241865). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2025-2423 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-202502423-1/ Link for SUSE-SU-2025:02423-1 https://lists.suse.com/pipermail/sle-updates/2025-July/040824.html E-Mail link for SUSE-SU-2025:02423-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1194400 SUSE Bug 1194400 https://bugzilla.suse.com/1212493 SUSE Bug 1212493 https://bugzilla.suse.com/1219964 SUSE Bug 1219964 https://bugzilla.suse.com/1222539 SUSE Bug 1222539 https://bugzilla.suse.com/1229008 SUSE Bug 1229008 https://bugzilla.suse.com/1241865 SUSE Bug 1241865 https://www.suse.com/security/cve/CVE-2021-25743/ SUSE CVE CVE-2021-25743 page https://www.suse.com/security/cve/CVE-2023-2431/ SUSE CVE CVE-2023-2431 page https://www.suse.com/security/cve/CVE-2024-0793/ SUSE CVE CVE-2024-0793 page https://www.suse.com/security/cve/CVE-2024-3177/ SUSE CVE CVE-2024-3177 page https://www.suse.com/security/cve/CVE-2025-22872/ SUSE CVE CVE-2025-22872 page kubernetes1.23-apiserver-1.23.17-150300.7.12.1 kubernetes1.23-client-1.23.17-150300.7.12.1 kubernetes1.23-client-bash-completion-1.23.17-150300.7.12.1 kubernetes1.23-client-common-1.23.17-150300.7.12.1 kubernetes1.23-client-fish-completion-1.23.17-150300.7.12.1 kubernetes1.23-controller-manager-1.23.17-150300.7.12.1 kubernetes1.23-kubeadm-1.23.17-150300.7.12.1 kubernetes1.23-kubelet-1.23.17-150300.7.12.1 kubernetes1.23-kubelet-common-1.23.17-150300.7.12.1 kubernetes1.23-proxy-1.23.17-150300.7.12.1 kubernetes1.23-scheduler-1.23.17-150300.7.12.1 kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events. CVE-2021-25743 moderate 2.1 AV:N/AC:H/Au:S/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202502423-1/ https://www.suse.com/security/cve/CVE-2021-25743.html CVE-2021-25743 https://bugzilla.suse.com/1194400 SUSE Bug 1194400 A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet. CVE-2023-2431 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202502423-1/ https://www.suse.com/security/cve/CVE-2023-2431.html CVE-2023-2431 https://bugzilla.suse.com/1212493 SUSE Bug 1212493 A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn. CVE-2024-0793 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202502423-1/ https://www.suse.com/security/cve/CVE-2024-0793.html CVE-2024-0793 https://bugzilla.suse.com/1219964 SUSE Bug 1219964 A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account's secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated. CVE-2024-3177 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202502423-1/ https://www.suse.com/security/cve/CVE-2024-3177.html CVE-2024-3177 https://bugzilla.suse.com/1222539 SUSE Bug 1222539 The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts). CVE-2025-22872 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202502423-1/ https://www.suse.com/security/cve/CVE-2025-22872.html CVE-2025-22872 https://bugzilla.suse.com/1241710 SUSE Bug 1241710