CVE-2017-1002102

Published: Mar 13, 2018Modified: Nov 21, 2024

5.6

Vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N

Exploitability: 1.1 / Impact: 4.0

Source: NVD

Description

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.

Affected (7)

Products: Kubernetes: Kubernetes

Kubernetes

1 product

Kubernetes

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Kubernetes Kubernetes	From 1.3.0 to 1.3.10
Kubernetes Kubernetes	From 1.4.0 to 1.4.12
Kubernetes Kubernetes	From 1.5.0 to 1.5.8
Kubernetes Kubernetes	From 1.6.0 to 1.6.13
Kubernetes Kubernetes	From 1.7.0 to 1.7.14
Kubernetes Kubernetes	From 1.8.0 to 1.8.9
Kubernetes Kubernetes	From 1.9.0 to 1.9.4

References (4)

https://access.redhat.com/errata/RHSA-2018:0475

Source: jordan@liggitt.net

Third Party Advisory

https://github.com/kubernetes/kubernetes/issues/60814

Source: jordan@liggitt.net

Issue TrackingVendor Advisory

https://access.redhat.com/errata/RHSA-2018:0475

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/kubernetes/kubernetes/issues/60814

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.