diff --git a/advisories/github-reviewed/2023/07/GHSA-qc2g-gmh6-95p4/GHSA-qc2g-gmh6-95p4.json b/advisories/github-reviewed/2023/07/GHSA-qc2g-gmh6-95p4/GHSA-qc2g-gmh6-95p4.json new file mode 100644 index 00000000000..104dafcf0ac --- /dev/null +++ b/advisories/github-reviewed/2023/07/GHSA-qc2g-gmh6-95p4/GHSA-qc2g-gmh6-95p4.json @@ -0,0 +1,142 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qc2g-gmh6-95p4", + "modified": "2023-07-05T22:46:57Z", + "published": "2023-07-03T21:30:57Z", + "aliases": [ + "CVE-2023-2727" + ], + "summary": "kube-apiserver vulnerable to policy bypass", + "details": "Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/kubernetes" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.27.0" + }, + { + "fixed": "1.27.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/kubernetes" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.26.0" + }, + { + "fixed": "1.26.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/kubernetes" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.25.0" + }, + { + "fixed": "1.25.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/kubernetes" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.24.15" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2727" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/issues/118640" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/pull/118356" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/pull/118471" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/pull/118473" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/pull/118474" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/pull/118512" + }, + { + "type": "PACKAGE", + "url": "https://github.com/kubernetes/kubernetes" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-07-05T22:46:57Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/07/GHSA-qc2g-gmh6-95p4/GHSA-qc2g-gmh6-95p4.json b/advisories/unreviewed/2023/07/GHSA-qc2g-gmh6-95p4/GHSA-qc2g-gmh6-95p4.json deleted file mode 100644 index 0e4039f72b8..00000000000 --- a/advisories/unreviewed/2023/07/GHSA-qc2g-gmh6-95p4/GHSA-qc2g-gmh6-95p4.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-qc2g-gmh6-95p4", - "modified": "2023-07-03T21:30:57Z", - "published": "2023-07-03T21:30:57Z", - "aliases": [ - "CVE-2023-2727" - ], - "details": "Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.\n\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2727" - }, - { - "type": "WEB", - "url": "https://github.com/kubernetes/kubernetes/issues/118640" - }, - { - "type": "WEB", - "url": "https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": null - } -} \ No newline at end of file