[Contribution] Add remaining GCP Bulletins

[ramimac]

Summary (give a brief description of the issue)

GCP-2023-007

A vulnerability was recently discovered in Cloud SQL for SQL Server that allowed customer administrator accounts to create triggers in the tempdb database and use those to gain sysadmin privileges in the instance. The sysadmin privileges would give the attacker access to system databases and partial access to the machine running that SQL Server instance.

Google Cloud resolved the issue by patching the security vulnerability by March 1, 2023. Google Cloud didn't find any compromised customer instances.

GCP-2022-011

There is a misconfiguration with Simultaneous Multi-Threading (SMT), also known as Hyper-threading, on GKE Sandbox images. The misconfiguration leaves nodes potentially exposed to side channel attacks such as Microarchitectural Data Sampling (MDS) (for more context, see GKE Sandbox documentation). We do not recommend using the following affected versions:

GCP-2022-009

Some unexpected paths to access the node VM on GKE Autopilot clusters could have been used to escalate privileges in the cluster. These issues have been fixed and no further action is required. The fixes address issues reported through our Vulnerability Reward Program.

GCP-2021-019

There is a known issue where updating a BackendConfig resource using the v1beta1 API removes an active Google Cloud Armor security policy from its service.

GCP-2021-022

A vulnerability has been discovered in the Anthos Identity Service (AIS) LDAP module of Anthos clusters on VMware versions 1.8 and 1.8.1 where a seed key used in generating keys is predictable. With this vulnerability, an authenticated user could add arbitrary claims and escalate privileges indefinitely.

References (provide links to blogposts, etc.)

1. GCP-2023-013
2. GCP-2023-007
3. GCP-2022-011
4. GCP-2022-009
5. GCP-2021-019
6. GCP-2021-022

[ramimac]

Note: inspired by #244

1. Searched https://cloud.google.com/support/bulletins for all bulletins that weren't due to a CVE
2. Removed the one that was previously added to open-cvdb

[korniko98]

Removed GCP-2022-009 since it's a duplicate of https://www.cloudvulndb.org/gke-autopilot-allowlist, and added the GCP security bulletin references to the existing entry.