Affected by GO-2022-0617 and 9 other vulnerabilities

GO-2022-0617: WITHDRAWN: Potential proxy IP restriction bypass in Kubernetes in k8s.io/kubernetes

GO-2022-0983: kubectl ANSI escape characters not filtered in k8s.io/kubernetes

GO-2023-1628: Kubernetes vulnerable to path traversal in k8s.io/kubernetes

GO-2023-1629: Kubernetes vulnerable to validation bypass in k8s.io/kubernetes

GO-2023-1864: Kubelet vulnerable to bypass of seccomp profile enforcement in k8s.io/kubernetes

GO-2023-1891: kube-apiserver vulnerable to policy bypass in k8s.io/kubernetes

GO-2023-1892: Kubernetes mountable secrets policy bypass in k8s.io/kubernetes

GO-2023-2341: Kubernetes Improper Input Validation vulnerability in k8s.io/kubernetes

GO-2024-2994: Kubernetes sets incorrect permissions on Windows containers logs in k8s.io/kubernetes

GO-2024-3277: Kubernetes Nil pointer dereference in KCM after v1 HPA patch request in k8s.io/kubernetes

scdeny

package

v1.22.13 Latest Latest Go to latest Published: Aug 17, 2022 License: Apache-2.0 Imports: 6 Imported by: 0

Details

View Source

const PluginName = "SecurityContextDeny"

PluginName indicates name of admission plugin.

This section is empty.

func Register(plugins *admission.Plugins)

Register registers a plugin

type Plugin struct {
	*admission.Handler
}

Plugin implements admission.Interface.

func NewSecurityContextDeny() *Plugin

NewSecurityContextDeny creates a new instance of the SecurityContextDeny admission controller

func (p *Plugin) Validate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error)

Validate will deny any pod that defines SupplementalGroups, SELinuxOptions, RunAsUser or FSGroup