Skip to content
OpenAdvisories
High ELSA-2023-25545 2 CVEs

Important: olcne security update (Oracle Linux 7)

Published Jul 3, 2023 · Updated Jul 3, 2023

Ecosystem: Oracle Linux

Summary

[1.6.2-1]
- CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11
- Add all modules to registry-image-helper
- update yq to 4.x

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 7 olcne-extra-modules 0:1.6.2-1.el7
Oracle Linux · 7 olcne-kubevirt-chart 0:1.6.2-1.el7
Oracle Linux · 7 olcne-rook-chart 0:1.6.2-1.el7

Vulnerabilities 2

  • Medium 6.5
    CVE-2023-2727

    Bypassing policies imposed by the ImagePolicyWebhook admission plugin

    Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go
  • Medium 6.5
    CVE-2023-2728 Public exploit

    Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin

    Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the…

    Kubernetes Kubernetes kubernetes k8s.io/kubernetes Debian Alpine Go