GitHub Advisoryadvisory · Go

GHSA-82m2-cv7p-4m75 Kubernetes sets incorrect permissions on Windows containers logs

HIGH Published 2024-07-18 Modified 2024-11-18 Official page ↗
Aliases
CVE-2024-5321
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-276
Reviewed
2024-07-18

Affected packages

• Go k8s.io/kubernetes: < 1.27.16 → fixed in 1.27.16 • Go k8s.io/kubernetes: >= 1.28.0, < 1.28.12 → fixed in 1.28.12 • Go k8s.io/kubernetes: >= 1.29.0, < 1.29.7 → fixed in 1.29.7 • Go k8s.io/kubernetes: >= 1.30.0, < 1.30.3 → fixed in 1.30.3

Description

A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs.

Related

Alias · CVE (1)

  • CVE-2024-5321 A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References