GitHub Advisoryadvisory · Go

GHSA-2jx2-76rc-2v7v Kubernetes Privilege Escalation

CRITICAL Published 2021-05-12 Modified 2023-09-18 Official page ↗
Aliases
CVE-2017-1000056
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-862
Reviewed
2022-09-08

Affected packages

• Go k8s.io/kubernetes: >= 1.5.0, < 1.5.5 → fixed in 1.5.5

Description

Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object.

Related

Alias · CVE (1)

  • CVE-2017-1000056 Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References