SB2023042049 - Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.1

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023042049

SB2023042049 - Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.1

Published: April 20, 2023 Updated: December 18, 2023

Security Bulletin ID SB2023042049
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Improper Control of Dynamically-Managed Code Resources (CVE-ID: CVE-2023-29017)

The vulnerability allows a remote attacker to escape sandbox restrictions.

The vulnerability exists due to improper handling of host objects passed to "Error.prepareStackTrace" in case of unhandled async errors. A remote attacker can pass specially crafted input to the application, escape sandbox restrictions and execute arbitrary code on the host.


2) Improper Control of Dynamically-Managed Code Resources (CVE-ID: CVE-2023-29199)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to an error within the source code transformer. A remote user can bypass handleException() and leak unsanitized host exceptions. The obtain information can be used to escape the sandbox and run arbitrary code in host context.


3) Code injection (CVE-ID: CVE-2023-30547)

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to an error in exception sanitization. A remote user can raise an unsanitized host exception inside "handleException()", which can be used to escape the sandbox and run arbitrary code in host context.


Remediation

Install update from vendor's website.

References