Ariel Zelivansky

**Name of the Vulnerable Software and Affected Versions** Kubernetes versions 1.1.0 through 1.16.10 Kubernetes versions 1.17.0 through 1.17.6 Kubernetes versions 1.18.0 through 1.18.3 **Description** A security issue in the Kubelet and kube-proxy components allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. This means that services thought to be reachable only by other processes on the same host could be accessed by other hosts on the same LAN or by containers on the same node. For instance, a TCP service running on a node and listening on 127.0.0.1:1234 could be potentially reachable by other hosts or containers, posing a risk if the service does not require additional authentication. IPv6-only services on localhost are not affected by this issue. **Recommendations** For versions 1.1.0 through 1.16.10, update to a version outside of this range to mitigate the risk. For versions 1.17.0 through 1.17.6, update to a version outside of this range to mitigate the risk. For versions 1.18.0 through 1.18.3, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider implementing additional authentication for services bound to 127.0.0.1 to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** NATS Server versions prior to 2.2.0 **Description** The issue is caused by an integer overflow that allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, the attacker must first authenticate. This can be exploited by sending a specifically crafted request to the server. **Recommendations** For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the server to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: kubectl versions prior to 1.11.9 kubectl versions prior to 1.12.7 kubectl versions prior to 1.13.5 kubectl versions prior to 1.14.0 Description: The issue arises from the `kubectl cp` command, which allows copying files between containers and the user machine. When copying files from a container, Kubernetes creates a tar inside the container, copies it over the network, and `kubectl` unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when `kubectl cp` is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. Recommendations: For versions prior to 1.11.9, update to version 1.11.9 or later. For versions prior to 1.12.7, update to version 1.12.7 or later. For versions prior to 1.13.5, update to version 1.13.5 or later. For versions prior to 1.14.0, update to version 1.14.0 or later.

**Name of the Vulnerable Software and Affected Versions** BusyBox version 1.27.2 **Description** The issue is related to an Integer Underflow in the decompress unlzma.c file of BusyBox, which leads to a read access violation. **Recommendations** For BusyBox version 1.27.2, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** gdk-pixbuf (affected versions not specified) **Description** The issue allows context-dependent attackers to cause a denial of service, specifically an infinite loop, by utilizing a large TIFF file. This is related to the make available at least function in io-tiff.c. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gdk-pixbuf (affected versions not specified) **Description** The issue is related to an integer underflow in the load resources function in io-icns.c, which allows context-dependent attackers to cause a denial of service, resulting in an out-of-bounds read and program crash. This can be achieved via a crafted image entry size in an ICO file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gdk-pixbuf (affected versions not specified) **Description** The issue is related to an integer overflow in the io-ico.c file of gdk-pixbuf, which allows attackers to cause a denial of service, resulting in a segmentation fault and application crash. This is achieved by providing a crafted image entry offset in an ICO file, triggering an out-of-bounds read. The issue is also related to compiler optimizations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gdk-pixbuf (affected versions not specified) **Description** The issue allows context-dependent attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash. This is achieved via vectors related to printing an error message. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.