Skip to content
OpenAdvisories
Medium · 6.5 CVE-2023-2727 EUVD-2023-2130GHSA-qc2g-gmh6-95p4GO-2023-1891

Bypassing policies imposed by the ImagePolicyWebhook admission plugin

Published Jul 3, 2023 · Updated Feb 13, 2025 · Assigned by kubernetes

Vendor: Kubernetes Product: Kubernetes Package: k8s.io/kubernetes Package: kubernetes Ecosystem: Debian Ecosystem: Go

Description

Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

Affected products

VendorProductAffectedFixed
Kubernetes Kubernetes v1.24.14 – ≤ <=, v1.25.0 - v1.25.10, v1.26.0 - v1.26.5, v1.27.0 - v1.27.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 kubernetes 1.20.5+really1.20.2-1 —
Debian 13 kubernetes 1.20.5+really1.20.2-1 —
Debian 12 kubernetes 1.20.5+really1.20.2-1 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Openshift Ironic 4 openstack-ironic +5 1:21.5.0-0.20231002130534.0df5961.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 openstack-ironic-inspector +4 11.5.0-0.20230706175125.193aa0d.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-automaton +1 3.1.0-0.20230608140652.a4f7631.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-cinderclient +1 9.3.0-0.20230608143053.f7a612e.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-cliff +2 4.3.0-0.20230608150702.72e81d7.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-debtcollector +1 2.5.0-0.20230308172820.a6b46c5.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-decorator +1 4.4.2-6.0.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-dracclient +1 8.0.0-0.20230308200614.9c7499c.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-fixtures +1 4.0.1-1.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-futurist +1 2.4.1-0.20230308173923.159d752.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-glanceclient +1 1:4.3.0-0.20230608143056.52fb6b2.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-hardware +2 0.30.0-0.20230308190813.f6ff0ed.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-ironic-lib +1 5.4.1-0.20230706172632.25d8671.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-ironic-prometheus-exporter +1 4.1.1-0.20230614150617.7b35627.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-keystoneauth1 +1 5.2.0-0.20230608152518.2e40bbf.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-keystoneclient +2 1:5.1.0-0.20230608141554.4763cd8.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-keystonemiddleware +1 10.3.0-0.20230608151410.92cdf8a.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-openstacksdk +2 1.2.0-0.20230608155226.b7ff031.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-os-service-types +1 1.7.0-0.20230308170555.0b2f473.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-os-traits +2 3.0.0-0.20230608152745.cff125c.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-osc-lib +2 2.8.0-0.20230608151456.db9cdc9.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-cache +3 3.4.0-0.20230608153448.a720016.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-concurrency +3 5.1.1-0.20230706190204.0af5942.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-config +1 2:9.1.1-0.20230608145954.515daab.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-context +2 5.1.1-0.20230608143931.7696282.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-db +3 12.3.1-0.20230608142355.b689b63.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-i18n +2 6.0.0-0.20230608140652.03605c2.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-log +3 5.2.0-0.20230608150750.16a8a42.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-messaging +2 14.3.1-0.20230608152013.0602d1a.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-middleware +3 5.1.1-0.20230608145931.7725ac9.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-policy +3 4.2.0-0.20230608153320.93129eb.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-rootwrap +2 7.0.1-0.20230608144658.b72372b.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-serialization +2 5.1.1-0.20230608144505.b4be3a4.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-service +2 3.1.1-0.20230608145222.b3ba591.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-upgradecheck +1 2.1.1-0.20230608143829.eeedfc9.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-utils +1 6.1.0-0.20230608142355.d49d594.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-oslo-versionedobjects +1 3.1.0-0.20230608141554.b4ea834.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-osprofiler 3.4.3-0.20230308173821.3286301.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-pbr 5.11.1-0.1.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-proliantutils 2.14.1-0.20230608154738.3de2844.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-pycadf +1 3.1.1-0.20230308171749.4179996.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-requestsexceptions 1.4.0-0.20230308170555.d7ac0ff.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-scciclient 0.12.3-0.20230308201513.0940a71.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-stevedore 5.1.0-0.20230608154210.2d99ccc.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-sushy 4.5.0-0.20230719180619.146ed33.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-sushy-oem-idrac 5.0.0-0.20230308202122.da9a0e4.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-swiftclient 4.3.0-0.20230608151934.236c277.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-tenacity 6.3.1-1.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-tooz 4.1.0-0.20230608154038.d5bf20c.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python-wrapt +1 1.14.1-1.el9 RHSA-2023:5009
Red Hat Openshift Ironic 4 python3-ironic-python-agent +2 9.5.0-0.20230728140546.fce0b8c.el9 RHSA-2023:5009
Red Hat OpenShift 4 afterburn +2 5.4.3-1.rhaos4.14.el9 RHSA-2023:5009
Red Hat OpenShift 4 bpftool 7.0.0-284.36.1.el9_2 RHSA-2023:5009
Red Hat OpenShift 4 buildah +1 1:1.29.1-10.1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 butane +1 0.19.0-1.1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 catch +1 3.3.2-1.el9 RHSA-2023:5009
Red Hat OpenShift 4 conmon 3:2.1.7-3.1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 container-selinux 3:2.221.0-1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 containernetworking-plugins 1.0.1-11.1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 containers-common 2:1-51.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 coreos-installer +2 0.17.0-1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 cri-o 1.27.1-8.1.rhaos4.14.git3fecb83.el8 RHSA-2023:5009
Red Hat OpenShift 4 cri-tools 1.27.0-2.1.el8 RHSA-2023:5009
Red Hat OpenShift 4 crun 1.9.2-1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 crun-wasm 0.0-3.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 fmt +1 9.1.0-1.el9 RHSA-2023:5009
Red Hat OpenShift 4 gmock +3 1.13.0-1.el9 RHSA-2023:5009
Red Hat OpenShift 4 google-benchmark +2 1.8.2-1.el9 RHSA-2023:5009
Red Hat OpenShift 4 haproxy +1 2.6.13-1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 ignition +1 2.16.2-1.1.rhaos4.14.el9 RHSA-2023:5009
Red Hat OpenShift 4 kata-containers 3.1.3-4.rhaos4.14.el9 RHSA-2023:5009
Red Hat OpenShift 4 kernel-rt +21 5.14.0-284.36.1.rt14.321.el9_2 RHSA-2023:5009
Red Hat OpenShift 4 microshift +3 4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 RHSA-2023:5008
Red Hat OpenShift 4 nmstate +4 2.2.12-1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 openshift +1 4.14.0-202310210404.p0.gf67aeb3.assembly.stream.el8 RHSA-2023:5009
Red Hat OpenShift 4 openshift-ansible +1 4.14.0-202310062327.p0.gf781421.assembly.stream.el8 RHSA-2023:5009
Red Hat OpenShift 4 openshift-clients +1 4.14.0-202310191146.p0.g0c63f9d.assembly.stream.el8 RHSA-2023:5009
Red Hat OpenShift 4 openshift-kuryr +4 4.14.0-202309272140.p0.g8926a29.assembly.stream.el8 RHSA-2023:5009
Red Hat OpenShift 4 openshift-prometheus-promu +1 0.15.0-15.1.gitd5383c5.el8 RHSA-2023:5009
Red Hat OpenShift 4 openshift4-aws-iso 4.14.0-202309272140.p0.gd2acdd5.assembly.stream.el8 RHSA-2023:5009
Red Hat OpenShift 4 ovn23.09 +3 23.09.0-37.el9fdp RHSA-2023:5009
Red Hat OpenShift 4 perf +60 5.14.0-284.36.1.el9_2 RHSA-2023:5009
Red Hat OpenShift 4 podman +6 3:4.4.1-10.1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 runc 4:1.1.9-2.1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 skopeo +1 2:1.11.2-10.1.rhaos4.14.el8 RHSA-2023:5009
Red Hat OpenShift 4 spdlog +1 1.12.0-1.rhaos4.14.el9 RHSA-2023:5009
Red Hat OpenShift 4 toolbox 0.1.2-1.rhaos4.14.el9 RHSA-2023:5009
Red Hat OpenShift 4 wasmedge +2 0.12.1-2.rhaos4.14.el9 RHSA-2023:5009

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 kubernetes1.23 1.23.17-150500.3.3.1 SUSE-SU-2023:2543-1
SLES 15 SP5 kubernetes1.24 1.24.13-150500.3.3.1 SUSE-SU-2023:2544-1
SLES 15 SP4 kubernetes1.18 1.18.10-150200.5.10.1 SUSE-SU-2023:2541-1
SLES 15 SP4 kubernetes1.23 1.23.17-150300.7.9.1 SUSE-SU-2023:2542-1
SLES 15 SP4 kubernetes1.24 1.24.16-150400.9.8.2 SUSE-SU-2024:3341-1, SUSE-SU-2023:3260-1
SLES 15 SP3 kubernetes1.18 1.18.10-150200.5.10.1 SUSE-SU-2023:2541-1
SLES 15 SP3 kubernetes1.23 1.23.17-150300.7.9.1 SUSE-SU-2023:2542-1
SLES 15 SP3 kubernetes1.24 1.24.17-150300.7.6.1 SUSE-SU-2024:3343-1
SLES 15 SP2 kubernetes1.18 1.18.10-150200.5.10.1 SUSE-SU-2023:2541-1
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP4 kubernetes1.24 1.24.17-150400.9.16.1 SUSE-SU-2024:3341-1
SLES for SAP 15 SP3 kubernetes1.18 1.18.10-150200.5.10.1 SUSE-SU-2023:2541-1
SLES for SAP 15 SP3 kubernetes1.23 1.23.17-150300.7.9.1 SUSE-SU-2023:2542-1
SLES for SAP 15 SP3 kubernetes1.24 1.24.17-150300.7.6.1 SUSE-SU-2024:3343-1
SLES for SAP 15 SP2 kubernetes1.18 1.18.10-150200.5.10.1 SUSE-SU-2023:2541-1
SLE HPC 15 SP4 kubernetes1.24 1.24.17-150400.9.16.1 SUSE-SU-2024:3341-1
SLE HPC 15 SP3 kubernetes1.18 1.18.10-150200.5.10.1 SUSE-SU-2023:2541-1
SLE HPC 15 SP3 kubernetes1.23 1.23.17-150300.7.9.1 SUSE-SU-2023:2542-1
SLE HPC 15 SP3 kubernetes1.24 1.24.17-150300.7.6.1 SUSE-SU-2024:3343-1
SLE HPC 15 SP2 kubernetes1.18 1.18.10-150200.5.10.1 SUSE-SU-2023:2541-1
SUSE Enterprise Storage 7.1 kubernetes1.18 1.18.10-150200.5.10.1 SUSE-SU-2023:2541-1
SUSE Enterprise Storage 7.1 kubernetes1.23 1.23.17-150300.7.9.1 SUSE-SU-2023:2542-1
SUSE Enterprise Storage 7.1 kubernetes1.24 1.24.17-150300.7.6.1 SUSE-SU-2024:3343-1
SUSE Enterprise Storage 7 kubernetes1.18 1.18.10-150200.5.10.1 SUSE-SU-2023:2541-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20250807T150727-1.1 openSUSE-SU-2025:15424-1
openSUSE Tumbleweed kubernetes1.23 1.23.17-4.1 openSUSE-SU-2024:13003-1
openSUSE Tumbleweed kubernetes1.24 1.24.15-1.1 openSUSE-SU-2024:13004-1
openSUSE Leap 15.5 kubernetes1.18 1.18.10-150200.5.10.1 SUSE-SU-2023:2541-1
openSUSE Leap 15.5 kubernetes1.23 1.23.17-150500.3.3.1 SUSE-SU-2023:2543-1
openSUSE Leap 15.5 kubernetes1.24 1.24.13-150500.3.3.1 SUSE-SU-2023:2544-1
openSUSE Leap 15.4 kubernetes1.18 1.18.10-150200.5.10.1 SUSE-SU-2023:2541-1
openSUSE Leap 15.4 kubernetes1.24 1.24.16-150400.9.8.2 SUSE-SU-2023:3260-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 kubeadm +2 1.24.15-1.el8 ELSA-2023-12564, ELSA-2023-12561
Oracle Linux 8 olcne-rook-chart +4 1.6.2-1.el8 ELSA-2023-25546, ELSA-2023-12564
Oracle Linux 8 olcnectl +11 1.5.13-1.el8 ELSA-2023-12564, ELSA-2023-12561
Oracle Linux 8 yq 4.34.1-1.el8 ELSA-2023-12564
Oracle Linux 7 kubeadm +2 1.24.15-1.el7 ELSA-2023-12563, ELSA-2023-12562
Oracle Linux 7 olcne-rook-chart +4 1.6.2-1.el7 ELSA-2023-25545, ELSA-2023-12563
Oracle Linux 7 olcnectl +11 1.5.13-1.el7 ELSA-2023-12563, ELSA-2023-12562
Oracle Linux 7 yq 4.34.1-1.el7 ELSA-2023-12563

Affected packages

EcosystemPackageAffectedFixedRecord
Go k8s.io/kubernetes >= 1.27.0, < 1.27.3 1.27.3 GHSA-qc2g-gmh6-95p4
Go k8s.io/kubernetes >= 1.26.0, < 1.26.6 1.26.6 GHSA-qc2g-gmh6-95p4
Go k8s.io/kubernetes >= 1.25.0, < 1.25.11 1.25.11 GHSA-qc2g-gmh6-95p4
Go k8s.io/kubernetes < 1.24.15 1.24.15 GHSA-qc2g-gmh6-95p4
Go k8s.io/kubernetes < 1.24.15 · >= 1.25.0, < 1.25.11 · >= 1.26.0, < 1.26.6 · >= 1.27.0, < 1.27.3 1.24.15, 1.25.11, 1.26.6, 1.27.3 GO-2023-1891

Advisories 19

References