PT-2018-5277 · Kubernetes · Kubernetes

Joel Smith · Published 2018-03-13 · Updated 2025-08-08 · CVE-2017-1002102

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Kubernetes versions 1.3.x through 1.6.x Kubernetes versions 1.7.x through 1.7.13 Kubernetes versions 1.8.x through 1.8.8 Kubernetes versions 1.9.x through 1.9.3

Description The issue allows containers using a secret, configMap, projected or downwardAPI volume to trigger deletion of arbitrary files/directories from the nodes where they are running.

Recommendations For Kubernetes versions 1.3.x through 1.6.x, update to version 1.7.14 or later. For Kubernetes versions 1.7.x through 1.7.13, update to version 1.7.14 or later. For Kubernetes versions 1.8.x through 1.8.8, update to version 1.8.9 or later. For Kubernetes versions 1.9.x through 1.9.3, update to version 1.9.4 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2017-1002102

GHSA-MM7G-F2GG-CW8G

GO-2023-1977

OPENSUSE-SU-2025:15424-1

RHSA-2018:0475

Affected Products

Kubernetes

References · 56

• https://github.com/kubernetes/kubernetes/issues/60814 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mm7g-f2gg-cw8g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1002102 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2018-4061.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0475 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1002102 · Security Note
• https://osv.dev/vulnerability/GO-2023-1977 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15424-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-1002102 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-1002102 · Vendor Advisory
• https://github.com/kubernetes/kubernetes · Note
• https://suse.com/security/cve/CVE-2023-2727 · Note
• https://suse.com/security/cve/CVE-2023-27561 · Note
• https://suse.com/security/cve/CVE-2025-47907 · Note
• https://suse.com/security/cve/CVE-2023-25809 · Note