GitHub Advisoryadvisory · Go

GHSA-vv39-3w5q-974q Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API

MEDIUM Published 2025-03-13 Modified 2025-03-13 Official page ↗
Aliases
CVE-2024-9042
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-20, CWE-77
Reviewed
2025-03-13

Affected packages

• Go k8s.io/kubernetes: < 1.29.13 → fixed in 1.29.13 • Go k8s.io/kubernetes: >= 1.30.0-alpha.0, < 1.30.9 → fixed in 1.30.9 • Go k8s.io/kubernetes: >= 1.31.0-alpha.0, < 1.31.5 → fixed in 1.31.5 • Go k8s.io/kubernetes: >= 1.32.0-alpha.0, < 1.32.1 → fixed in 1.32.1

Description

A security vulnerability has been discovered in Kubernetes windows nodes that could allow a user with the ability to query a node's '/logs' endpoint to execute arbitrary commands on the host. This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.

Related

Alias · CVE (1)

  • CVE-2024-9042 This CVE affects only Windows worker nodes. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References