GitHub Advisoryadvisory · Go

GHSA-27wf-5967-98gx Kubernetes kubelet arbitrary command execution

HIGH Published 2024-11-22 Modified 2024-12-13 Official page ↗
Aliases
CVE-2024-10220
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-22
Reviewed
2024-11-22

Affected packages

• Go k8s.io/kubernetes: < 1.28.12 → fixed in 1.28.12 • Go k8s.io/kubernetes: >= 1.29.0, < 1.29.7 → fixed in 1.29.7 • Go k8s.io/kubernetes: >= 1.30.0, < 1.30.3 → fixed in 1.30.3

Description

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

Related

Alias · CVE (1)

  • CVE-2024-10220 The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet:… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References