CVE-2017-1002102

Published: Mar 13, 2018Modified: Nov 21, 2024

5.6

Vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N

Exploitability: 1.1 / Impact: 4.0

Source: NVD

Description

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.

Affected (7)

Products: Kubernetes: Kubernetes

Kubernetes

1 product

Kubernetes

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Kubernetes Kubernetes	1.3.0 ≤ version ≤ 1.3.10
Kubernetes Kubernetes	1.4.0 ≤ version ≤ 1.4.12
Kubernetes Kubernetes	1.5.0 ≤ version ≤ 1.5.8
Kubernetes Kubernetes	1.6.0 ≤ version ≤ 1.6.13
Kubernetes Kubernetes	1.7.0 ≤ version < 1.7.14
Kubernetes Kubernetes	1.8.0 ≤ version < 1.8.9
Kubernetes Kubernetes	1.9.0 ≤ version < 1.9.4

References (4)

https://access.redhat.com/errata/RHSA-2018:0475

Source: jordan@liggitt.net

Third Party Advisory

https://github.com/kubernetes/kubernetes/issues/60814

Source: jordan@liggitt.net

Issue TrackingVendor Advisory

https://access.redhat.com/errata/RHSA-2018:0475

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/kubernetes/kubernetes/issues/60814

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.