{"id":"CVE-2024-3177","aliases":["AZL-40016","AZL-40051","DEBIAN-CVE-2024-3177","EUVD-2024-1273","GHSA-pxhw-596r-rwq5","GO-2024-2746","MGASA-2024-0389","OESA-2024-1550","OESA-2024-1576","OESA-2024-1577","OESA-2024-1579","OESA-2024-1580","OESA-2024-1626","RHSA-2024:0043","RHSA-2024:2054","SUSE-SU-2024:1403-1","SUSE-SU-2024:1404-1","SUSE-SU-2024:3341-1","SUSE-SU-2024:3343-1","SUSE-SU-2025:02423-1","SUSE-SU-2025:02423-2","UBUNTU-CVE-2024-3177"],"status":"published","title":"Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin","description":"A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02224,"percentile":0.82846,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2024-04-22T23:00:39Z","modified":"2026-11-02T12:00:12Z","exploits":[{"source":"pocgithub","id":"Cgv-Dev/Metasploit-Module-TFM","title":"Cgv-Dev/Metasploit-Module-TFM","date":"2024-09-05","url":"https://github.com/Cgv-Dev/Metasploit-Module-TFM"}],"fixes":[{"ecosystem":"Go","package":"k8s.io/kubernetes","fixed_in":["1.27.13","1.29.4","1.28.9"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"kubernetes","fixed_in":["1.30.1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"kubernetes","fixed_in":["1.20.5+really1.20.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"kubernetes","fixed_in":["1.20.5+really1.20.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kubernetes","fixed_in":["1.20.5+really1.20.2-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"kubernetes","fixed_in":["1.20.2-21.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"kubernetes","fixed_in":["1.20.2-21.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"kubernetes","fixed_in":["1.20.2-21.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"kubernetes","fixed_in":["1.20.2-21.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"kubernetes","fixed_in":["1.20.2-23.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"kubernetes","fixed_in":["1.20.2-21.oe2203sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP5","package":"kubernetes1.24","fixed_in":["1.24.17-150500.3.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"kubernetes1.24","fixed_in":["1.24.17-150500.3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP5","package":"kubernetes1.23","fixed_in":["1.23.17-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"kubernetes1.23","fixed_in":["1.23.17-150500.3.12.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.13"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.29.0"},{"last_affected":"1.29.3"},{"fixed":"1.29.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.28.0"},{"last_affected":"1.28.8"},{"fixed":"1.28.9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.28.4-25"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.13"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.29.0"},{"fixed":"1.29.4"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.28.0"},{"fixed":"1.28.9"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.13"},{"introduced":"1.28.0"},{"fixed":"1.28.9"},{"introduced":"1.29.0"},{"fixed":"1.29.4"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.16-2.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-21.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-21.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-21.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-21.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-23.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-21.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"microshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"microshift-greenboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"microshift-multus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"microshift-multus-release-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"microshift-networking","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"microshift-olm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"microshift-olm-release-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"microshift-release-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"microshift-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0-202404231437.p0.g401bb48.assembly.stream.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0-202404231437.p0.g401bb48.assembly.stream.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0-202404231437.p0.g401bb48.assembly.stream.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0-202404231437.p0.g401bb48.assembly.stream.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.11.3-0.1.rhaos4.14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.11.3-0.1.rhaos4.14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.11.3-0.1.rhaos4.14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.11.3-0.1.rhaos4.14.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.11.3-0.1.rhaos4.14.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.11.3-0.1.rhaos4.14.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.11.3-0.1.rhaos4.14.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.11.3-0.1.rhaos4.14.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP5","package":"kubernetes1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.17-150500.3.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kubernetes1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.17-150500.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP5","package":"kubernetes1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.17-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kubernetes1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.17-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kubernetes1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.17-150400.9.16.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kubernetes1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.17-150400.9.16.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kubernetes1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.17-150400.9.16.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kubernetes1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.17-150400.9.16.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"kubernetes1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.17-150300.7.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"kubernetes1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.17-150300.7.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"kubernetes1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.17-150300.7.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"kubernetes1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.17-150300.7.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"kubernetes1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.17-150300.7.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kubernetes1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.17-150300.7.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kubernetes1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.17-150300.7.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"kubernetes1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.17-150300.7.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kubernetes1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.17-150300.7.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"kubernetes1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.17-150300.7.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kubernetes1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.17-150300.7.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"kubernetes1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.17-150300.7.12.1"}]}],"bundled":5}],"products":[{"vendor":"kubernetes","product":"kubernetes"}],"references":[{"url":"https://groups.google.com/g/kubernetes-security-announce/c/JxjHf7fkVd8/m/oVCzypyOAQAJ","tags":["mailing-list","x_transferred","article","web","report"]},{"url":"https://github.com/kubernetes/kubernetes/issues/124336","tags":["issue-tracking","x_transferred","report","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WL54MTLGMTBZZO5PYGEGEBERTMADC4WC/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/04/16/4","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3177","tags":["web","advisory"]},{"url":"https://github.com/kubernetes/kubernetes/commit/7c861b1ecad97e1ab9332c970c9294a72065111a","tags":["web","fix"]},{"url":"https://github.com/kubernetes/kubernetes/commit/a619ca3fd3ee3c222d9df784622020de398076d2","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/commit/f9fb6cf52a769a599a45e700375115c2ecc86e9b","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WL54MTLGMTBZZO5PYGEGEBERTMADC4WC","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pxhw-596r-rwq5","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2746","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3177.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-3177","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2024-0389.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33143","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33802","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/11/20/1","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1550","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1576","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1577","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1579","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1580","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1626","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0043","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274118","tags":["report"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-21901","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-23336","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-24444","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-24689","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-25030","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-25784","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-27849","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-29037","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-29847","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-30039","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-30807","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-30833","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-31739","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-32946","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-33588","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0043.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-3177","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-3177","tags":["advisory","report"]},{"url":"https://discuss.kubernetes.io/t/security-advisory-cve-2024-3177-bypassing-mountable-secrets-policy-imposed-by-the-serviceaccount-admission-plugin/27905","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24786","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24786","tags":["advisory"]},{"url":"https://go.dev/cl/569356","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2611","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2054","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268854","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2054.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28180","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28180","tags":["advisory"]},{"url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241403-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222539","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3177","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241404-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243341-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1062303","tags":["report"]},{"url":"https://bugzilla.suse.com/1194400","tags":["report"]},{"url":"https://bugzilla.suse.com/1211630","tags":["report"]},{"url":"https://bugzilla.suse.com/1211631","tags":["report"]},{"url":"https://bugzilla.suse.com/1214406","tags":["report"]},{"url":"https://bugzilla.suse.com/1216109","tags":["report"]},{"url":"https://bugzilla.suse.com/1216123","tags":["report"]},{"url":"https://bugzilla.suse.com/1219964","tags":["report"]},{"url":"https://bugzilla.suse.com/1221400","tags":["report"]},{"url":"https://bugzilla.suse.com/1226136","tags":["report"]},{"url":"https://bugzilla.suse.com/1229858","tags":["report"]},{"url":"https://bugzilla.suse.com/1229867","tags":["report"]},{"url":"https://bugzilla.suse.com/1229869","tags":["report"]},{"url":"https://bugzilla.suse.com/1230323","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24786","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243343-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502423-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1212493","tags":["report"]},{"url":"https://bugzilla.suse.com/1229008","tags":["report"]},{"url":"https://bugzilla.suse.com/1241865","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502423-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-3177","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-3177","title":"Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin","description":"A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.","status":"published","published":"2024-04-22T23:00:39.702Z","modified":"2024-09-10T20:48:09.78Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:10.613319Z"}],"euvd":[{"id":"EUVD-2024-1273","description":"A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.","status":"published","published":"2024-04-22T23:00:39Z","modified":"2024-09-10T20:48:09Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-03T00:55:58.744683Z"}],"ghsa":[{"id":"GHSA-pxhw-596r-rwq5","title":"Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin","description":"A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.\n\n","status":"published","published":"2024-04-23T00:30:45Z","modified":"2024-07-03T20:24:59Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:55.455438Z"}],"nvd":[{"id":"CVE-2024-3177","description":"A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.","status":"published","published":"2024-04-22T23:15:51.18Z","modified":"2026-06-17T07:43:28.34Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:09:53.50104Z"}],"osv":[{"id":"CVE-2024-3177","title":"Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin","description":"A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.","status":"published","published":"2024-04-22T23:00:39.702Z","modified":"2026-10-28T02:30:27.519369592Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"DEBIAN-CVE-2024-3177","description":"A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.","status":"published","published":"2024-04-22T23:15:51.18Z","modified":"2026-11-02T12:00:12.839565283Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-pxhw-596r-rwq5","title":"Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin","description":"A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.\n\n","status":"published","published":"2024-04-23T00:30:45Z","modified":"2026-09-10T03:50:12.868674238Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"OESA-2024-1550","title":"kubernetes security update","description":"Container cluster management.\r\n\r\nSecurity Fix(es):\r\n\r\nA security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.\r\n\r\n(CVE-2024-3177)","status":"published","published":"2024-05-10T11:07:00Z","modified":"2026-08-18T01:18:25.315169328Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1576","title":"kubernetes security update","description":"Container cluster management.\r\n\r\nSecurity Fix(es):\r\n\r\nA security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.\r\n\r\n(CVE-2024-3177)","status":"published","published":"2024-05-17T11:07:02Z","modified":"2026-08-18T01:18:25.93600599Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1577","title":"kubernetes security update","description":"Container cluster management.\r\n\r\nSecurity Fix(es):\r\n\r\nA security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.\r\n\r\n(CVE-2024-3177)","status":"published","published":"2024-05-17T11:07:02Z","modified":"2026-08-18T01:18:25.582808706Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1579","title":"kubernetes security update","description":"Container cluster management.\r\n\r\nSecurity Fix(es):\r\n\r\nA security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.\r\n\r\n(CVE-2024-3177)","status":"published","published":"2024-05-17T11:07:02Z","modified":"2026-08-18T01:18:25.582603243Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1580","title":"kubernetes security update","description":"Container cluster management.\r\n\r\nSecurity Fix(es):\r\n\r\nA security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.\r\n\r\n(CVE-2024-3177)","status":"published","published":"2024-05-17T11:07:02Z","modified":"2026-08-18T01:18:26.03828452Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1626","title":"kubernetes security update","description":"Container cluster management.\r\n\r\nSecurity Fix(es):\r\n\r\nA security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.\r\n\r\n(CVE-2024-3177)","status":"published","published":"2024-05-24T11:07:05Z","modified":"2026-08-18T01:18:27.316471277Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2024:0043","title":"Red Hat Security Advisory: Red Hat build of MicroShift 4.16.0 security update","status":"published","published":"2024-10-01T23:06:16Z","modified":"2026-10-20T10:02:27Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:2054","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.23 security update","status":"published","published":"2024-10-02T10:55:39Z","modified":"2026-10-16T10:04:12Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"UBUNTU-CVE-2024-3177","description":"A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.","status":"withdrawn","published":"2024-04-22T23:15:00Z","modified":"2025-07-14T06:46:42.797006Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"AZL-40016","title":"CVE-2024-3177 affecting package kubernetes for versions less than 1.30.1-1","description":"A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.","status":"published","published":"2024-04-22T23:15:51Z","modified":"2026-04-21T04:47:37.147728Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-40051","title":"CVE-2024-3177 affecting package kubernetes 1.28.4-25","description":"A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.","status":"published","published":"2024-04-22T23:15:51Z","modified":"2026-04-21T04:28:54.50091Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"GO-2024-2746","title":"Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin in k8s.io/kubernetes","description":"Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin in k8s.io/kubernetes","status":"published","published":"2024-06-04T15:19:21Z","modified":"2026-02-04T03:50:36.073637Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"MGASA-2024-0389","title":"Updated kubernetes packages fix security vulnerabilities","description":"A security issue was discovered in Kubernetes where users may be able to\nlaunch containers that bypass the mountable secrets policy enforced by\nthe ServiceAccount admission plugin when using containers, init\ncontainers, and ephemeral containers with the envFrom field populated.\nThe policy ensures pods running with a service account may only\nreference secrets specified in the service account’s secrets field.\nKubernetes clusters are only affected if the ServiceAccount admission\nplugin and the kubernetes.io/enforce-mountable-secrets annotation are\nused together with containers, init containers, and ephemeral containers\nwith the envFrom field populated. CVE-2024-3177\nThe Kubernetes kubelet component allows arbitrary command execution via\nspecially crafted gitRepo volumes. CVE-2024-10220\n","status":"published","published":"2024-12-06T17:09:22Z","modified":"2026-04-16T04:44:02.557268952Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2024:1403-1","title":"Security update for kubernetes1.24","description":"This update for kubernetes1.24 fixes the following issues:\n\n- CVE-2024-3177: Fixed bypass of mountable secrets policy imposed by the ServiceAccount admission plugin (bsc#1222539)\n","status":"published","published":"2024-04-23T14:52:34Z","modified":"2026-02-04T03:53:33.828262Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1404-1","title":"Security update for kubernetes1.23","description":"This update for kubernetes1.23 fixes the following issues:\n\n- CVE-2024-3177: Fixed bypass of mountable secrets policy imposed by the ServiceAccount admission plugin (bsc#1222539)\n","status":"published","published":"2024-04-23T14:52:51Z","modified":"2026-02-04T03:30:10.247708Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:3341-1","title":"Security update for kubernetes1.23","description":"This update for kubernetes1.23 fixes the following issues:\n\n- CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized. (bsc#1194400)\n- CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)\n- CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1211631)\n- CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets. (bsc#1229869)  \n- CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)\n- CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers. (bsc#1229869)\n- CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests. (bsc#1219964)  \n- CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1222539)\n- CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)\n\nBug fixes:\n\n- Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)\n- Fix multiple issues for successful `kubeadm init` run. (bsc#1214406)\n- Update go to version 1.22.5 in build requirements. (bsc#1229858)\n","status":"published","published":"2024-09-19T14:50:41Z","modified":"2026-02-04T02:53:55.286421Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3343-1","title":"Security update for kubernetes1.24","description":"This update for kubernetes1.24 fixes the following issues:\n\n- CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized. (bsc#1194400)\n- CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)\n- CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1211631)\n- CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets. (bsc#1229869)  \n- CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)\n- CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers. (bsc#1229869)\n- CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests. (bsc#1219964)  \n- CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1222539)\n- CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)\n\nBug fixes:\n\n- Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)\n- Fix multiple issues for successful `kubeadm init` run. (bsc#1214406)\n- Update go to version 1.22.5 in build requirements. (bsc#1229858)\n","status":"published","published":"2024-09-19T14:51:26Z","modified":"2026-02-04T02:57:24.002344Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2025:02423-1","title":"Security update for kubernetes1.23","description":"This update for kubernetes1.23 fixes the following issues:\n\n- CVE-2021-25743: Escape terminal special characters in kubectl output (bsc#1194400).\n- CVE-2023-2431: Prevent pods to bypass the seccomp profile enforcement (bsc#1212493).\n- CVE-2024-0793: Advance autoscaling v2 as the preferred API version (bsc#1219964).\n- CVE-2024-3177: Prevent bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (bsc#1222539). \n- CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content (bsc#1241865).\n","status":"published","published":"2025-07-21T08:36:40Z","modified":"2026-03-23T04:49:40.854316Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02423-2","title":"Security update for kubernetes1.23","description":"This update for kubernetes1.23 fixes the following issues:\n\n- CVE-2021-25743: Escape terminal special characters in kubectl output (bsc#1194400).\n- CVE-2023-2431: Prevent pods to bypass the seccomp profile enforcement (bsc#1212493).\n- CVE-2024-0793: Advance autoscaling v2 as the preferred API version (bsc#1219964).\n- CVE-2024-3177: Prevent bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (bsc#1222539). \n- CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content (bsc#1241865).\n","status":"published","published":"2025-08-13T00:10:52Z","modified":"2026-02-04T03:20:50.480082Z","updated_at":"2026-11-02T15:53:56.647031Z"}]}}