The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3343-1 advisory.

    - CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized.
    (bsc#1194400)
    - CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)
    - CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1211631)
    - CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets.
    (bsc#1229869)
    - CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)
    - CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers.
    (bsc#1229869)
    - CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests.
    (bsc#1219964)
    - CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1222539)
    - CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)

    Bug fixes:

    - Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)
    - Fix multiple issues for successful `kubeadm init` run. (bsc#1214406)
    - Update go to version 1.22.5 in build requirements. (bsc#1229858)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2541-1 advisory.

  - Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using     ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is     used together with ephemeral containers. (CVE-2023-2727)

  - Users may be able to launch containers that bypass the mountable secrets policy enforced by the     ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a     service account may only reference secrets specified in the service account's secrets field. Kubernetes     clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-     mountable-secrets` annotation are used together with ephemeral containers. (CVE-2023-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0872 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2021-25749:
    Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option     to true.

    CVE-2022-3172:
    A security issue was discovered in kube-apiserver that allows an     aggregated API server to redirect client traffic to any URL.  This could      lead to the client performing unexpected actions as well as forwarding     the client's API server credentials to third parties.

    CVE-2022-3294:
    Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only     affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports     node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish     connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying     address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this     validation could allow authenticated requests destined for Nodes to to the API server/'s private network.

    CVE-2023-2431:
    A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement.
    Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this     issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode.
    This bug affects Kubelet.

    CVE-2023-2728:
    Users may be able to launch containers that bypass the mountable secrets policy enforced by the     ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a     service account may only reference secrets specified in the service accounts secrets field. Kubernetes     clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-     mountable-secrets` annotation are used together with ephemeral containers.

    CVE-2023-2727:
    Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using     ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is     used together with ephemeral containers.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the kubernetes package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
207490	SUSE SLES15 Security Update : kubernetes1.24 (SUSE-SU-2024:3343-1)	Nessus	SuSE Local Security Checks	2024/9/20	2024/9/20	critical
177437	SUSE SLES15 / openSUSE 15 Security Update : kubernetes1.18 (SUSE-SU-2023:2541-1)	Nessus	SuSE Local Security Checks	2023/6/19	2023/7/14	medium
239505	TencentOS Server 4: kubernetes (TSSA-2024:0872)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/4	high
204171	Photon OS 5.0: Kubernetes PHSA-2023-5.0-0043	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	critical
203746	Photon OS 3.0: Kubernetes PHSA-2023-3.0-0631	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	critical

检测

插件搜索

critical

medium

high

critical

critical