kubernetes1.23 (SUSE:Linux Enterprise Module for Containers 15 SP4) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Containers 15 SP4 package kubernetes1.23, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (5)

• CVE-2021-25749 — CVSS 7.8 (high): Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.
• CVE-2022-3294 — CVSS 6.6 (medium): Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can…
• CVE-2022-3162 — CVSS 6.5 (medium): Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the…
• CVE-2023-2727 — CVSS 6.5 (medium): Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes…
• CVE-2023-2728 — CVSS 6.5 (medium): Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using…