Security update for kubernetes1.23 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:2691-1 Final 1 1 2023-06-28T15:12:34Z current 2023-06-28T15:12:34Z 2023-06-28T15:12:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for kubernetes1.23 This update for kubernetes1.23 fixes the following issues: - CVE-2023-2431: Fixed a bypass issue of seccomp profile enforcement (bsc#1212493). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-2691,SUSE-SLE-Module-Containers-15-SP5-2023-2691,openSUSE-SLE-15.5-2023-2691 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20232691-1/ Link for SUSE-SU-2023:2691-1 https://lists.suse.com/pipermail/sle-updates/2023-June/030117.html E-Mail link for SUSE-SU-2023:2691-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1212493 SUSE Bug 1212493 https://www.suse.com/security/cve/CVE-2023-2431/ SUSE CVE CVE-2023-2431 page SUSE Linux Enterprise Module for Containers 15 SP5 openSUSE Leap 15.5 kubernetes1.23-apiserver-1.23.17-150500.3.6.1 kubernetes1.23-client-1.23.17-150500.3.6.1 kubernetes1.23-client-bash-completion-1.23.17-150500.3.6.1 kubernetes1.23-client-common-1.23.17-150500.3.6.1 kubernetes1.23-client-fish-completion-1.23.17-150500.3.6.1 kubernetes1.23-controller-manager-1.23.17-150500.3.6.1 kubernetes1.23-kubeadm-1.23.17-150500.3.6.1 kubernetes1.23-kubelet-1.23.17-150500.3.6.1 kubernetes1.23-kubelet-common-1.23.17-150500.3.6.1 kubernetes1.23-proxy-1.23.17-150500.3.6.1 kubernetes1.23-scheduler-1.23.17-150500.3.6.1 kubernetes1.23-client-1.23.17-150500.3.6.1 as a component of SUSE Linux Enterprise Module for Containers 15 SP5 kubernetes1.23-client-common-1.23.17-150500.3.6.1 as a component of SUSE Linux Enterprise Module for Containers 15 SP5 kubernetes1.23-apiserver-1.23.17-150500.3.6.1 as a component of openSUSE Leap 15.5 kubernetes1.23-client-1.23.17-150500.3.6.1 as a component of openSUSE Leap 15.5 kubernetes1.23-client-bash-completion-1.23.17-150500.3.6.1 as a component of openSUSE Leap 15.5 kubernetes1.23-client-common-1.23.17-150500.3.6.1 as a component of openSUSE Leap 15.5 kubernetes1.23-client-fish-completion-1.23.17-150500.3.6.1 as a component of openSUSE Leap 15.5 kubernetes1.23-controller-manager-1.23.17-150500.3.6.1 as a component of openSUSE Leap 15.5 kubernetes1.23-kubeadm-1.23.17-150500.3.6.1 as a component of openSUSE Leap 15.5 kubernetes1.23-kubelet-1.23.17-150500.3.6.1 as a component of openSUSE Leap 15.5 kubernetes1.23-kubelet-common-1.23.17-150500.3.6.1 as a component of openSUSE Leap 15.5 kubernetes1.23-proxy-1.23.17-150500.3.6.1 as a component of openSUSE Leap 15.5 kubernetes1.23-scheduler-1.23.17-150500.3.6.1 as a component of openSUSE Leap 15.5 A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet. CVE-2023-2431 SUSE Linux Enterprise Module for Containers 15 SP5:kubernetes1.23-client-1.23.17-150500.3.6.1 SUSE Linux Enterprise Module for Containers 15 SP5:kubernetes1.23-client-common-1.23.17-150500.3.6.1 openSUSE Leap 15.5:kubernetes1.23-apiserver-1.23.17-150500.3.6.1 openSUSE Leap 15.5:kubernetes1.23-client-1.23.17-150500.3.6.1 openSUSE Leap 15.5:kubernetes1.23-client-bash-completion-1.23.17-150500.3.6.1 openSUSE Leap 15.5:kubernetes1.23-client-common-1.23.17-150500.3.6.1 openSUSE Leap 15.5:kubernetes1.23-client-fish-completion-1.23.17-150500.3.6.1 openSUSE Leap 15.5:kubernetes1.23-controller-manager-1.23.17-150500.3.6.1 openSUSE Leap 15.5:kubernetes1.23-kubeadm-1.23.17-150500.3.6.1 openSUSE Leap 15.5:kubernetes1.23-kubelet-1.23.17-150500.3.6.1 openSUSE Leap 15.5:kubernetes1.23-kubelet-common-1.23.17-150500.3.6.1 openSUSE Leap 15.5:kubernetes1.23-proxy-1.23.17-150500.3.6.1 openSUSE Leap 15.5:kubernetes1.23-scheduler-1.23.17-150500.3.6.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232691-1/ https://www.suse.com/security/cve/CVE-2023-2431.html CVE-2023-2431 https://bugzilla.suse.com/1212493 SUSE Bug 1212493