SB2023042050 - Red Hat Advanced Cluster Management for Kubernetes 2.5 update for vm2

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023042050

SB2023042050 - Red Hat Advanced Cluster Management for Kubernetes 2.5 update for vm2

Published: April 20, 2023 Updated: December 18, 2023

Security Bulletin ID SB2023042050
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Improper Control of Dynamically-Managed Code Resources (CVE-ID: CVE-2023-29017)

The vulnerability allows a remote attacker to escape sandbox restrictions.

The vulnerability exists due to improper handling of host objects passed to "Error.prepareStackTrace" in case of unhandled async errors. A remote attacker can pass specially crafted input to the application, escape sandbox restrictions and execute arbitrary code on the host.


2) Improper Control of Dynamically-Managed Code Resources (CVE-ID: CVE-2023-29199)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to an error within the source code transformer. A remote user can bypass handleException() and leak unsanitized host exceptions. The obtain information can be used to escape the sandbox and run arbitrary code in host context.


3) Code injection (CVE-ID: CVE-2023-30547)

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to an error in exception sanitization. A remote user can raise an unsanitized host exception inside "handleException()", which can be used to escape the sandbox and run arbitrary code in host context.


Remediation

Install update from vendor's website.

References