CVE-2025-24376 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2025-24376 Interim 1 12 2026-03-05T01:12:33Z current 2025-02-06T00:12:51Z 2026-03-05T01:12:33Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2025-24376 kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. By design, AdmissionPolicy and AdmissionPolicyGroup can evaluate only namespaced resources. The resources to be evaluated are determined by the rules provided by the user when defining the policy. There might be Kubernetes namespaced resources that should not be validated by AdmissionPolicy and by the AdmissionPolicyGroup policies because of their sensitive nature. For example, PolicyReport are namespaced resources that contain the list of non compliant objects found inside of a namespace. An attacker can use either an AdmissionPolicy or an AdmissionPolicyGroup to prevent the creation and update of PolicyReport objects to hide non-compliant resources. Moreover, the same attacker might use a mutating AdmissionPolicy to alter the contents of the PolicyReport created inside of the namespace. Starting from the 1.21.0 release, the validation rules applied to AdmissionPolicy and AdmissionPolicyGroup have been tightened to prevent them from validating sensitive types of namespaced resources. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2025-February/020315.html E-Mail link for SUSE-SU-2025:0429-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE SUSE Linux Enterprise Server 16.0 openSUSE Tumbleweed govulncheck-vulndb-0.0.20250204T220613-1.1 govulncheck-vulndb-0.0.20250814T182633-160000.1.2 libxml2-2-2.11.6-slfo.1.1_6.1 libxml2-tools-2.11.6-slfo.1.1_6.1 libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Container suse/sl-micro/6.0/baremetal-os-container:latest libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Container suse/sl-micro/6.0/base-os-container:latest libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Container suse/sl-micro/6.0/kvm-os-container:latest libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Container suse/sl-micro/6.0/rt-os-container:latest libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Container suse/sl-micro/6.0/toolbox:latest libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-RT libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-RT libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-RT-SelfInstall libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-RT-SelfInstall libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-RT-encrypted libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-RT-encrypted libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-SelfInstall libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-SelfInstall libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-encrypted libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-encrypted libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-qcow libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Base-qcow libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Default libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Default libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Default-SelfInstall libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Default-SelfInstall libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Default-encrypted libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Default-encrypted libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Default-qcow libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SL-Micro-Default-qcow libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-Azure libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-Azure libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-BYOS libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-BYOS libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-BYOS-Azure libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-BYOS-Azure libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-BYOS-EC2 libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-BYOS-EC2 libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-BYOS-GCE libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-BYOS-GCE libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-EC2 libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-EC2 libxml2-2-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-GCE libxml2-tools-2.11.6-slfo.1.1_6.1 as a component of Image SLE-Micro-GCE govulncheck-vulndb-0.0.20250814T182633-160000.1.2 as a component of SUSE Linux Enterprise Server 16.0 govulncheck-vulndb-0.0.20250204T220613-1.1 as a component of openSUSE Tumbleweed kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. By design, AdmissionPolicy and AdmissionPolicyGroup can evaluate only namespaced resources. The resources to be evaluated are determined by the rules provided by the user when defining the policy. There might be Kubernetes namespaced resources that should not be validated by AdmissionPolicy and by the AdmissionPolicyGroup policies because of their sensitive nature. For example, PolicyReport are namespaced resources that contain the list of non compliant objects found inside of a namespace. An attacker can use either an AdmissionPolicy or an AdmissionPolicyGroup to prevent the creation and update of PolicyReport objects to hide non-compliant resources. Moreover, the same attacker might use a mutating AdmissionPolicy to alter the contents of the PolicyReport created inside of the namespace. Starting from the 1.21.0 release, the validation rules applied to AdmissionPolicy and AdmissionPolicyGroup have been tightened to prevent them from validating sensitive types of namespaced resources. CVE-2025-24376 Container suse/sl-micro/6.0/baremetal-os-container:latest:libxml2-2-2.11.6-slfo.1.1_6.1 Container suse/sl-micro/6.0/base-os-container:latest:libxml2-2-2.11.6-slfo.1.1_6.1 Container suse/sl-micro/6.0/kvm-os-container:latest:libxml2-2-2.11.6-slfo.1.1_6.1 Container suse/sl-micro/6.0/rt-os-container:latest:libxml2-2-2.11.6-slfo.1.1_6.1 Container suse/sl-micro/6.0/toolbox:latest:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-RT:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-RT:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-RT-SelfInstall:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-RT-SelfInstall:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-RT-encrypted:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-RT-encrypted:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-SelfInstall:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-SelfInstall:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-VMware:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-VMware:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-encrypted:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-encrypted:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-qcow:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Base-qcow:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default-SelfInstall:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default-SelfInstall:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default-VMware:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default-VMware:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default-encrypted:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default-encrypted:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default-qcow:libxml2-2-2.11.6-slfo.1.1_6.1 Image SL-Micro-Default-qcow:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SLE-Micro:libxml2-2-2.11.6-slfo.1.1_6.1 Image SLE-Micro:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SLE-Micro-Azure:libxml2-2-2.11.6-slfo.1.1_6.1 Image SLE-Micro-Azure:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SLE-Micro-BYOS:libxml2-2-2.11.6-slfo.1.1_6.1 Image SLE-Micro-BYOS:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SLE-Micro-BYOS-Azure:libxml2-2-2.11.6-slfo.1.1_6.1 Image SLE-Micro-BYOS-Azure:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SLE-Micro-BYOS-EC2:libxml2-2-2.11.6-slfo.1.1_6.1 Image SLE-Micro-BYOS-EC2:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SLE-Micro-BYOS-GCE:libxml2-2-2.11.6-slfo.1.1_6.1 Image SLE-Micro-BYOS-GCE:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SLE-Micro-EC2:libxml2-2-2.11.6-slfo.1.1_6.1 Image SLE-Micro-EC2:libxml2-tools-2.11.6-slfo.1.1_6.1 Image SLE-Micro-GCE:libxml2-2-2.11.6-slfo.1.1_6.1 Image SLE-Micro-GCE:libxml2-tools-2.11.6-slfo.1.1_6.1 SUSE Linux Enterprise Server 16.0:govulncheck-vulndb-0.0.20250814T182633-160000.1.2 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250204T220613-1.1 moderate