PT-2018-5276 · Linux Foundation+1 · Kubernetes+1

Maxim Ivanov

·

Publicado

2018-03-13

·

Atualizado

2022-03-04

·

CVE-2017-1002101

CVSS v3.1

9.6

Crítica

VetorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Kubernetes versions 1.3.x through 1.6.x Kubernetes versions 1.7.x through 1.7.13 Kubernetes versions 1.8.x through 1.8.8 Kubernetes versions 1.9.x through 1.9.3
Description The issue allows containers using subpath volume mounts to access files and directories outside of the volume, including the host's filesystem, due to a flaw in Kubernetes. This affects containers with any volume type, including non-privileged pods, subject to file permissions.
Recommendations For Kubernetes versions 1.3.x through 1.6.x, update to version 1.7.14 or later. For Kubernetes versions 1.7.x through 1.7.13, update to version 1.7.14 or later. For Kubernetes versions 1.8.x through 1.8.8, update to version 1.8.9 or later. For Kubernetes versions 1.9.x through 1.9.3, update to version 1.9.4 or later.

Exploit

Correção

Link Following

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2017-1002101
OPENSUSE-SU-2020:0554-1
OPENSUSE-SU-2020_0554-1
OPENSUSE-SU-2024:10901-1
RHSA-2018:0475

Produtos afetados

Kubernetes
Suse