| Name | CVE-2023-2727 |
| Description | Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| kubernetes (PTS) | bullseye | 1.20.5+really1.20.2-1 | fixed |
| bookworm, sid, trixie | 1.20.5+really1.20.2-1.1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| kubernetes | source | (unstable) | 1.20.5+really1.20.2-1 | | | |
Notes
Server components no longer built since 1.20.5+really1.20.2-1, marking that as fixed version
The source package itself it still vulnerable, but custom rebuilds are not really a usecase here
https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8
https://github.com/kubernetes/kubernetes/issues/118640