Repository: kubernetes
Issue: Kubernetes 1.24 Third-Party Security Audit Findings
Labels: priority/important-longterm,lifecycle/rotten,sig/security,needs-triage

This issue is to track the findings from the third-party security audit of Kubernetes 1.24 performed by NCC Group on behalf of the CNCF. The intent is to have a place to track the community's response and remediation to these issues now that they've been made public.

The full output of the assessment is available on the [External Audit subproject](https://github.com/kubernetes/sig-security/tree/main/sig-security-external-audit) site, and this issue specifically tracks the findings from the [Kubernetes 1.24 Security Audit Report](https://github.com/kubernetes/sig-security/blob/main/sig-security-external-audit/security-audit-2021-2022/findings/Kubernetes%20v1.24%20Final%20Report.pdf)

| # | Title | Issue | Status |
| -- | -- | -- | -- |
| 1 |  Additive Access Controls | https://github.com/kubernetes/kubernetes/issues/118982 | wontfix
| 2 |  Multiple Concerns with Network Policies |  https://github.com/kubernetes/kubernetes/issues/118983 | wontfix
| 3 |  Lack of Cohesion Between Core Access Control Mechanisms | https://github.com/kubernetes/kubernetes/issues/118985 | RBAC recommendation declined, admission recommendation addressed via ValidatingAdmissionPolicy + authorization calls
| 4 |  Weaknesses in Pod Security Standards Restricted Profile | https://github.com/kubernetes/kubernetes/issues/118987
| 5 |  Common Certificate Authority Possible for Client CA and Request Header CA | https://github.com/kubernetes/kubernetes/issues/119267
| 6 |  Path Traversal in Namespace Specifier | https://github.com/kubernetes/kubernetes/issues/119269 | fixed
| 7 |  Redirection of API Server Traffic to Kubelet | https://github.com/kubernetes/kubernetes/issues/119270
| 8 |  API Server Proxy Disables TLS Certificate Validation | https://github.com/kubernetes/kubernetes/issues/119625
| 9 |  Authentication Source Not Shown in Audit Logs | https://github.com/kubernetes/kubernetes/issues/119626
| 10 |  EmptyDir Volumes Do Not Support Mount Options | https://github.com/kubernetes/kubernetes/issues/119627
| 11 |  Loopback Token Usable Externally | https://github.com/kubernetes/kubernetes/issues/119628
| 12 |  Inaccurate X-Forwarded-Uri Header | https://github.com/kubernetes/kubernetes/issues/119629
| 13 |  Logging of Incorrect Bootstrap Tokens | https://github.com/kubernetes/kubernetes/issues/119630 | fixed
| 14 |  Incorrect Handling of Proxy Authentication Headers | https://github.com/kubernetes/kubernetes/issues/119631 | fixed
| 15 |  Timing Side Channel in Bootstrap Tokens Generation and Handling | https://github.com/kubernetes/kubernetes/issues/119632 | fixed
| 16 |  Non Constant-Time Comparison of Service Account Token Secrets | https://github.com/kubernetes/kubernetes/issues/119638 | not a security issue, but fixed
| 17 | Low Entropy Bootstrap Tokens | https://github.com/kubernetes/kubernetes/issues/119639 | needs KEP
| 18 |  Privilege Escalation via `nodes/proxy` Permission | https://github.com/kubernetes/kubernetes/issues/119640
| 19 |  Dangerous File Path Construction |  https://github.com/kubernetes/kubernetes/issues/119641

Please note, we are currently creating the issues and this umbrella issue will be updated as issues are created