GitHub Advisoryadvisory · Go

GHSA-f5f7-6478-qm6p Files or Directories Accessible to External Parties in kubernetes

HIGH Published 2021-11-01 Modified 2021-11-01 Official page ↗
Aliases
CVE-2021-25741
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-20, CWE-552
Reviewed
2021-11-01

Affected packages

• Go k8s.io/kubernetes: < 1.19.15 → fixed in 1.19.15 • Go k8s.io/kubernetes: >= 1.20.0, < 1.20.11 → fixed in 1.20.11 • Go k8s.io/kubernetes: >= 1.21.0, < 1.21.5 → fixed in 1.21.5 • Go k8s.io/kubernetes: >= 1.22.0, < 1.22.2 → fixed in 1.22.2

Description

A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

Related

Alias · CVE (1)

  • CVE-2021-25741 A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files &… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-552 Files or Directories Accessible to External Parties weakness

References