GHSA-hq6q-c2x6-hmch: Input Validation
First published: Tue Nov 14 2023(Updated: )
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/k8s.io/kubernetes | <1.25.16 | 1.25.16 |
| go/k8s.io/kubernetes | >=1.26.0<1.26.11 | 1.26.11 |
| go/k8s.io/kubernetes | >=1.27.0<1.27.8 | 1.27.8 |
| go/k8s.io/kubernetes | >=1.28.0<1.28.4 | 1.28.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2023-5528
- https://github.com/kubernetes/kubernetes/issues/121879
- https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzA
- https://github.com/kubernetes/kubernetes/pull/121881
- https://github.com/kubernetes/kubernetes/pull/121882
- https://github.com/kubernetes/kubernetes/pull/121883
- https://github.com/kubernetes/kubernetes/pull/121884
- https://github.com/kubernetes/kubernetes/pull/121885
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JH444PWZBINXLLFV7XLIJIZJHSK6UEZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4XZIX727JIKF5RQW7RVVBLWXBCDIBJA7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MPGMITSZXUCAVO7Q75675SOLXC2XXU4/
- https://security.netapp.com/advisory/ntap-20240119-0009/
- https://github.com/advisories/GHSA-hq6q-c2x6-hmch (Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JH444PWZBINXLLFV7XLIJIZJHSK6UEZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4XZIX727JIKF5RQW7RVVBLWXBCDIBJA7
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MPGMITSZXUCAVO7Q75675SOLXC2XXU4
- https://security.netapp.com/advisory/ntap-20240119-0009
Frequently Asked Questions
What is the severity of GHSA-hq6q-c2x6-hmch?
The severity of GHSA-hq6q-c2x6-hmch is high.
How does the vulnerability in GHSA-hq6q-c2x6-hmch affect Kubernetes clusters?
Kubernetes clusters are affected if they are using an in-tree storage plugin for Windows nodes.
How can the vulnerability in GHSA-hq6q-c2x6-hmch be exploited?
A user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes.
What is the recommended version to fix GHSA-hq6q-c2x6-hmch?
To fix GHSA-hq6q-c2x6-hmch, update to version 1.25.16, 1.26.11, 1.27.8, or 1.28.4 of Kubernetes.
Where can I find more information about GHSA-hq6q-c2x6-hmch?
More information about GHSA-hq6q-c2x6-hmch can be found at the following references: [CVE-2023-5528](https://nvd.nist.gov/vuln/detail/CVE-2023-5528), [GitHub issue](https://github.com/kubernetes/kubernetes/issues/121879), [Google group discussion](https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzA).
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/description
- agent/event
- collector/github-advisory
- source/GitHub
- alias/GHSA-hq6q-c2x6-hmch
- alias/CVE-2023-5528
- agent/software-canonical-lookup
- agent/tags
- collector/github-advisory-latest
- package-manager/go