Контейнеры: уязвимости стека · Страница 4

Moby authz zero length regression

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low. Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it. A security issue was discovere

• Обновитесь до 20.10.21-0ubuntu1~18.04.3+esm1
• Обновитесь до 20.10.21-0ubuntu1~20.04.6+esm1
• Обновитесь до 20.10.21-0ubuntu1~22.04.7+esm1
• Обновитесь до 20.10.24+dfsg1-1+deb12u1
• Обновитесь до 20.10.25+dfsg1-2ubuntu1+esm1
• Обновитесь до 26.1.3-0ubuntu1~20.04.1+esm1
• Обновитесь до 26.1.3-0ubuntu1~22.04.1+esm1
• Обновитесь до 26.1.3-0ubuntu1~24.04.1+esm1
• Обновитесь до 26.1.5+dfsg1-2
• Обновитесь до 27.5.1-0ubuntu3~22.04.2
• Обновитесь до 27.5.1-0ubuntu3~24.04.2

Incorrect permissions on Windows containers logs

A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs.

Privilege escalation in Calico CNI install binary

In vulnerable versions of Calico (v3.27.2 and below), Calico Enterprise (v3.19.0-1, v3.18.1, v3.17.3 and below), and Calico Cloud (v19.2.0 and below), an attacker who has local access to the Kubernetes node, can escalate their privileges by exploiting a vulnerability in the Calico CNI install binary. The issue arises from an incorrect SUID (Set User ID) bit configuration in the binary, combined with the ability to control the input binary, allowing an attacker to execute an arbitrary binary with elevated privileges.

• Обновитесь до v19.3.0
• Обновитесь до v3.17.4
• Обновитесь до v3.18.2
• Обновитесь до v3.19.0-2.0
• Обновитесь до v3.26.5
• Обновитесь до v3.27.3

Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin

A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field pop

• Обновитесь до 1.20.5+really1.20.2-1

Moby IPv6 enabled on IPv4-only network interfaces

Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. In 26.0.0, IPv6 is not disabled on network interfaces, including those belonging to networks where `--ipv6=false`. An container with an `ipvlan` or `macvlan` interface will normally be configured to share an external network link with the host machine. Because of this direct access, (1) Containers may be able to communicate with other hosts on the local network over link-local IPv6 addresses, (2) if router advertisements are being broadcast over the local network, containers may get SLA

• Обновитесь до 26.1.3-0ubuntu1~20.04.1+esm1
• Обновитесь до 26.1.4+dfsg1-9
• Обновитесь до 27.5.1-0ubuntu3~22.04.2

External DNS requests from 'internal' networks could lead to data exfiltration

Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may speci

• Обновитесь до 18.09.7-0ubuntu1~16.04.9+esm2
• Обновитесь до 20.10.21-0ubuntu1~18.04.3+esm2
• Обновитесь до 26.1.3-0ubuntu1~20.04.1+esm1
• Обновитесь до 26.1.3-0ubuntu1~22.04.1+esm1
• Обновитесь до 26.1.3-0ubuntu1~24.04.1+esm1
• Обновитесь до 26.1.4+dfsg1-9
• Обновитесь до 27.5.1-0ubuntu3~22.04.2
• Обновитесь до 27.5.1-0ubuntu3~24.04.2

Moby classic builder cache poisoning

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endp

• Обновитесь до 26.1.3-0ubuntu1~20.04.1+esm1
• Обновитесь до 26.1.4+dfsg1-9
• Обновитесь до 27.5.1-0ubuntu3~22.04.2
• Обновитесь до 27.5.1-0ubuntu3~24.04.2

runc container breakout through process.cwd trickery and leaked fds

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for com

• Обновитесь до 1.1.12+ds1-1
• Обновитесь до 1.1.4-0ubuntu1~18.04.2+esm1
• Обновитесь до 1.1.5+ds1-1+deb12u1
• Обновитесь до 1.1.7-0ubuntu1~20.04.2
• Обновитесь до 1.1.7-0ubuntu1~22.04.2

Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation

A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.

Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties.

• Обновитесь до 1.20.5+really1.20.2-1

Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

• Обновитесь до 1.20.5+really1.20.2-1

Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

• Обновитесь до 1.20.5+really1.20.2-1

Windows kube-proxy LoadBalancer contention

Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a LoadBalancer Service when the LoadBalancer controller does not set the “status.loadBalancer.ingress[].ip” field. Clusters where the LoadBalancer controller sets the “status.loadBalancer.ingress[].ip” field are unaffected.

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.

• Обновитесь до 1.9.0

Ingress nginx annotation injection causes arbitrary command execution

Ingress nginx annotation injection causes arbitrary command execution.

• Обновитесь до 1.9.0

Ingress-nginx `path` sanitization can be bypassed with `log_format` directive

Ingress-nginx `path` sanitization can be bypassed with `log_format` directive.

• Обновитесь до 1.8.0

Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin

Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.

• Обновитесь до 1.20.5+really1.20.2-1

Bypassing policies imposed by the ImagePolicyWebhook admission plugin

Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

• Обновитесь до 1.20.5+really1.20.2-1

Bypass of seccomp profile enforcement

A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.

• Обновитесь до 1.20.5+really1.20.2-1
• Обновитесь до v1.24.14
• Обновитесь до v1.25.9
• Обновитесь до v1.26.4
• Обновитесь до v1.27.1

runAsNonRoot logic bypass for Windows containers

Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.

• Обновитесь до v1.22.14