GitHub Advisoryadvisory · Go

GHSA-wqwf-x5cj-rg56 Kubernetes Arbitrary Command Injection

MEDIUM Published 2022-02-15 Modified 2023-10-02 Official page ↗
Aliases
CVE-2018-1002101
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-78
Reviewed
2021-05-12

Affected packages

• Go k8s.io/kubernetes: >= 1.9.0, < 1.9.10 → fixed in 1.9.10 • Go k8s.io/kubernetes: >= 1.10.0, < 1.10.6 → fixed in 1.10.6 • Go k8s.io/kubernetes: >= 1.11.0, < 1.11.2 → fixed in 1.11.2

Description

In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection. Specific Go Packages Affected k8s.io/kubernetes/pkg/util/mount

Related

Alias · CVE (1)

  • CVE-2018-1002101 In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References