PT-2017-2596 · Kubernetes · Kubernetes

Liggitt · Published 2017-03-21 · Updated 2025-08-08 · CVE-2017-1000056

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kubernetes versions 1.5.0 through 1.5.4

Description The issue is related to a plugin for accessing PodSecurityPolicy, a software tool for managing clusters of virtual machines in Kubernetes, and is associated with insufficient access control. Exploitation of this issue may allow a remote attacker to escalate their privileges, granting them the ability to use any existing PodSecurityPolicy object.

Recommendations For Kubernetes versions 1.5.0 through 1.5.4, update to a version that includes a fix for the privilege escalation issue in the PodSecurityPolicy admission plugin. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

CWE-264

Related Identifiers

BDU:2017-01812

CVE-2017-1000056

GHSA-2JX2-76RC-2V7V

GO-2023-1492

OPENSUSE-SU-2025:15424-1

Affected Products

Kubernetes

References · 56

• https://osv.dev/vulnerability/openSUSE-SU-2025:15424-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01812 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-1000056 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000056 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2jx2-76rc-2v7v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000056 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-1000056 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1492 · Vendor Advisory
• https://github.com/kubernetes/kubernetes · Note
• https://github.com/kubernetes/kubernetes/issues/43459 · Note
• https://github.com/kubernetes/kubernetes/commit/7fef0a4f6a44ea36f166c39fdade5324eff2dd5e · Note
• https://suse.com/security/cve/CVE-2020-8563 · Note
• https://suse.com/security/cve/CVE-2025-47908 · Note
• https://suse.com/security/cve/CVE-2022-29162 · Note
• https://suse.com/security/cve/CVE-2020-26240 · Note