← Back

CVE-2017-1002101

nvd nist
Published: Mar 13, 2018Modified: Nov 21, 2024

JSON object

Loading...
9.6
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Exploitability: 3.1 / Impact: 5.8
Source: NVD

Description

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem.

Affected (7)

Kubernetes
1 product
Kubernetes
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Kubernetes
Kubernetes
From 1.3.0 to 1.3.10
Kubernetes
From 1.4.0 to 1.4.12
Kubernetes
From 1.5.0 to 1.5.8
Kubernetes
From 1.6.0 to 1.6.13
Kubernetes
From 1.7.0 to 1.7.14
Kubernetes
From 1.8.0 to 1.8.9
Kubernetes
From 1.9.0 to 1.9.4

Related CWEs

CWE-59
Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (8)

Source: jordan@liggitt.net
Source: jordan@liggitt.net
Third Party Advisory
Source: jordan@liggitt.net
ExploitThird Party Advisory
Source: jordan@liggitt.net
Issue TrackingMitigationVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingMitigationVendor Advisory

Timeline

No history available yet.