Vulnerability · Published Nov 2, 2023 · Assigned by redhat
CVE-2023-5408Openshift: modification of node role labels
High 7.2
In plain English
A high-severity privilege mismanagement in Red Hat OpenShift Container Platform 4.11 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.5%top 25.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader access to the cluster.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.11 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | see references |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- RHSA-2023:5006 vendor-advisory, x_refsource_REDHAT
- RHSA-2023:6130 vendor-advisory, x_refsource_REDHAT
- RHSA-2023:6842 vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7479 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-5408 vdb-entry, x_refsource_REDHAT
- RHBZ#2242173 issue-tracking, x_refsource_REDHAT
- https://github.com/openshift/kubernetes/pull/1736