Paulo Gomes

Name of the Vulnerable Software and Affected Versions: Kubernetes versions prior to 1.27.16 Kubernetes versions prior to 1.28.12 Kubernetes versions prior to 1.29.7 Kubernetes versions prior to 1.30.4 Description: A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTINUsers may be able to read container logs and NT AUTHORITYAuthenticated Users may be able to modify container logs. The issue is related to incorrectly used default permissions in the kubelet utility for managing virtual machine clusters in Kubernetes for Windows operating systems. This could allow an attacker to modify information stored in container logs. Recommendations: For Kubernetes versions prior to 1.27.16, update to version 1.27.16 or later. For Kubernetes versions prior to 1.28.12, update to version 1.28.12 or later. For Kubernetes versions prior to 1.29.7, update to version 1.29.7 or later. For Kubernetes versions prior to 1.30.4, update to version 1.30.4 or later.

**Name of the Vulnerable Software and Affected Versions** Rancher versions prior to 2.6.14 Rancher versions prior to 2.7.10 Rancher versions prior to 2.8.2 **Description** A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. The issue affects deployments with Rancher Audit Logging enabled and AUDIT LEVEL set to 1 or above. Sensitive data that may be leaked includes HTTP headers, API server calls returning Secret objects, raw command lines used by agents, and Kubeconfig contents. The severity of the vulnerability is tied to the logging strategy employed and the permissions of the leaked credentials. **Recommendations** For versions prior to 2.6.14, update to version 2.6.14 or later to resolve the issue. For versions prior to 2.7.10, update to version 2.7.10 or later to resolve the issue. For versions prior to 2.8.2, update to version 2.8.2 or later to resolve the issue. As a temporary workaround, consider disabling the Audit feature or decreasing the AUDIT LEVEL to 0 to mitigate the issue. If AUDIT LEVEL 1 or above is required and updating to a patched version is not possible, ensure that the log is handled appropriately and not shared with other users or shipped into a log ingestion solution without proper RBAC enforcement.

**Name of the Vulnerable Software and Affected Versions** Weave GitOps versions prior to v0.12.0 **Description** A vulnerability in GitOps run could allow a local user or process to alter a Kubernetes cluster's resources. GitOps run has a local S3 bucket which it uses for synchronizing files that are later applied against a Kubernetes cluster. Its endpoint had no security controls to block unauthorized access, therefore allowing local users (and processes) on the same machine to see and alter the bucket content. By leveraging this vulnerability, an attacker could pick a workload of their choosing and inject it into the S3 bucket, which resulted in the successful deployment in the target cluster, without the need to provide any credentials to either the S3 bucket nor the target Kubernetes cluster. **Recommendations** To resolve the issue, upgrade to Weave GitOps version >= v0.12.0 released on 08/12/2022. As a temporary workaround, consider restricting access to the local S3 bucket to minimize the risk of exploitation.