← Back

CVE-2023-2431

nvd nist
Published: Jun 16, 2023Modified: Jun 17, 2026

JSON object

Loading...
5.5
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Exploitability: 1.8 / Impact: 3.6
Source: NVD

Description

A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.

Affected (5)

Kubernetes
1 product
Kubernetes
Fedoraproject
1 product
Fedora
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Kubernetes
Kubernetes
Before 1.24.14
Kubernetes
From 1.25.0 to 1.25.10
Kubernetes
From 1.26.0 to 1.26.5
Kubernetes
From 1.27.0 to 1.27.2
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Fedora
Version 38

Related CWEs

CWE-1287
Improper Validation of Specified Type of Input
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

References (9)

Source: jordan@liggitt.net
Issue Tracking
Source: jordan@liggitt.net
Mailing List
Source: jordan@liggitt.net
Source: jordan@liggitt.net
Mailing List
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Issue Tracking

Timeline

No history available yet.