GitHub Advisoryadvisory · Go

GHSA-mm7g-f2gg-cw8g Kubernetes arbitrary file overwrite

MEDIUM Published 2022-05-13 Modified 2023-09-07 Official page ↗
Aliases
CVE-2017-1002102
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Weaknesses
CWE-284
Reviewed
2023-07-26

Affected packages

• Go k8s.io/kubernetes: >= 1.3.0, < 1.7.14 → fixed in 1.7.14 • Go k8s.io/kubernetes: >= 1.8.0, < 1.8.9 → fixed in 1.8.9 • Go k8s.io/kubernetes: >= 1.9.0, < 1.9.4 → fixed in 1.9.4

Description

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.

Related

Alias · CVE (1)

  • CVE-2017-1002102 In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap,… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References