id: GO-2024-2746
modules:
    - module: k8s.io/kubernetes
      versions:
        - fixed: 1.27.13
        - introduced: 1.28.0
        - fixed: 1.28.9
        - introduced: 1.29.0
        - fixed: 1.29.4
      vulnerable_at: 1.29.3
      packages:
        - package: k8s.io/kubernetes/plugin/pkg/admission/serviceaccount
          symbols:
            - Plugin.limitSecretReferences
summary: |-
    Kubernetes allows bypassing mountable secrets policy imposed by the
    ServiceAccount admission plugin in k8s.io/kubernetes
cves:
    - CVE-2024-3177
ghsas:
    - GHSA-pxhw-596r-rwq5
references:
    - advisory: https://github.com/advisories/GHSA-pxhw-596r-rwq5
    - fix: https://github.com/kubernetes/kubernetes/commit/7c861b1ecad97e1ab9332c970c9294a72065111a
    - web: https://github.com/kubernetes/kubernetes/issues/124336
    - web: https://groups.google.com/g/kubernetes-security-announce/c/JxjHf7fkVd8/m/oVCzypyOAQAJ
source:
    id: GHSA-pxhw-596r-rwq5
    created: 2024-05-17T16:12:44.610818-04:00
review_status: REVIEWED