pepelyaevip/vuln-list-update
1
0
Fork 0
Code Pull Requests Actions Packages Releases Activity
8d2a522b96
vuln-list-update/k8s/testdata/expected-vulndb.json
chenk 8d2a522b96
fix: cve file name validation (#244)
2023-09-28 10:28:05 +03:00

1 line
48 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

[{"id":"CVE-2023-2431","modified":"2023-06-15T14:42:32Z","published":"2023-06-15T14:42:32Z","summary":"Bypass of seccomp profile enforcement ","details":"A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.24.14"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"}],"ranges":[{"events":[{"introduced":"1.25.0"},{"fixed":"1.25.9"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"}],"ranges":[{"events":[{"introduced":"1.26.0"},{"fixed":"1.26.4"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"}],"ranges":[{"events":[{"introduced":"1.27.0"},{"fixed":"1.27.1"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/118690"},{"url":"https://www.cve.org/cverecord?id=CVE-2023-2431"}]},{"id":"CVE-2023-2727","modified":"2023-06-13T14:42:06Z","published":"2023-06-13T14:42:06Z","summary":"Bypassing policies imposed by the ImagePolicyWebhook and bypassing mountable secrets policy imposed by the ServiceAccount admission plugin","details":"Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.\n\n","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.24.0"},{"last_affected":"1.24.14"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.25.0"},{"last_affected":"1.25.10"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.26.0"},{"last_affected":"1.26.5"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.27.0"},{"last_affected":"1.27.2"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/118640"},{"url":"https://www.cve.org/cverecord?id=CVE-2023-2727, CVE-2023-2728"}]},{"id":"CVE-2023-2728","modified":"2023-06-13T14:42:06Z","published":"2023-06-13T14:42:06Z","summary":"Bypassing policies imposed by the ImagePolicyWebhook and bypassing mountable secrets policy imposed by the ServiceAccount admission plugin","details":"Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.\n\n","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.24.0"},{"last_affected":"1.24.14"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.25.0"},{"last_affected":"1.25.10"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.26.0"},{"last_affected":"1.26.5"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.27.0"},{"last_affected":"1.27.2"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/118640"},{"url":"https://www.cve.org/cverecord?id=CVE-2023-2727, CVE-2023-2728"}]},{"id":"CVE-2023-2878","modified":"2023-06-02T19:03:54Z","published":"2023-06-02T19:03:54Z","summary":"secrets-store-csi-driver discloses service account tokens in logs","details":"Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs.\n","affected":[{"package":{"ecosystem":"kubernetes","name":"sigs.k8s.io/secrets-store-csi-driver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.3.3"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/118419"},{"url":"https://www.cve.org/cverecord?id=CVE-2023-2878"}]},{"id":"CVE-2022-3294","modified":"2022-11-08T21:33:26Z","published":"2022-11-08T21:33:26Z","summary":"Node address isn't always verified when proxying","details":"Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.25.0"},{"last_affected":"1.25.3"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.24.0"},{"last_affected":"1.24.7"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.23.0"},{"last_affected":"1.23.13"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.22.0"},{"last_affected":"1.22.15"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/113757"},{"url":"https://www.cve.org/cverecord?id=CVE-2022-3294"}]},{"id":"CVE-2022-3162","modified":"2022-11-08T21:33:07Z","published":"2022-11-08T21:33:07Z","summary":"Unauthorized read of Custom Resources","details":"Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.25.0"},{"last_affected":"1.25.3"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.24.0"},{"last_affected":"1.24.7"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.23.0"},{"last_affected":"1.23.13"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.22.0"},{"last_affected":"1.22.15"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/113756"},{"url":"https://www.cve.org/cverecord?id=CVE-2022-3162"}]},{"id":"CVE-2021-25749","modified":"2022-09-01T21:02:01Z","published":"2022-09-01T21:02:01Z","summary":"`runAsNonRoot` logic bypass for Windows containers","details":"Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.22.0"},{"fixed":"1.22.14"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.23.0"},{"fixed":"1.23.11"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.24.0"},{"fixed":"1.24.5"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/112192"},{"url":"https://www.cve.org/cverecord?id=CVE-2021-25749"}]},{"id":"CVE-2021-25741","modified":"2021-09-13T20:58:56Z","published":"2021-09-13T20:58:56Z","summary":"Symlink Exchange Can Allow Host Filesystem Access","details":"A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files \u0026 directories outside of the volume, including on the host filesystem.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.19.0"},{"last_affected":"1.19.14"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.20.0"},{"last_affected":"1.20.10"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.21.0"},{"last_affected":"1.21.4"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.22.0"},{"last_affected":"1.22.1"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/104980"},{"url":"https://www.cve.org/cverecord?id=CVE-2021-25741"}]},{"id":"CVE-2021-25737","modified":"2021-05-18T19:14:27Z","published":"2021-05-18T19:14:27Z","summary":"Holes in EndpointSlice Validation Enable Host Network Hijack","details":"A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.18.0"},{"last_affected":"1.18.18"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.19.0"},{"last_affected":"1.19.10"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.20.0"},{"last_affected":"1.20.6"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.21.0"},{"last_affected":"1.21.0"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/102106"},{"url":"https://www.cve.org/cverecord?id=CVE-2021-25737"}]},{"id":"CVE-2021-25735","modified":"2021-03-10T18:18:01Z","published":"2021-03-10T18:18:01Z","summary":"Validating Admission Webhook does not observe some previous fields","details":"A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.18.0"},{"last_affected":"1.18.17"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.19.0"},{"last_affected":"1.19.9"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.20.0"},{"last_affected":"1.20.5"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/100096"},{"url":"https://www.cve.org/cverecord?id=CVE-2021-25735"}]},{"id":"CVE-2020-8566","modified":"2020-10-15T22:07:53Z","published":"2020-10-15T22:07:53Z","summary":"Ceph RBD adminSecrets exposed in logs when loglevel \u003e= 4","details":"In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects \u003c v1.19.3, \u003c v1.18.10, \u003c v1.17.13.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/controller-manager"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.19.0"},{"fixed":"1.19.3"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/controller-manager"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.18.0"},{"fixed":"1.18.10"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/controller-manager"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.17.0"},{"fixed":"1.17.13"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/95624"},{"url":"https://www.cve.org/cverecord?id=CVE-2020-8566"}]},{"id":"CVE-2020-8565","modified":"2020-10-15T22:05:32Z","published":"2020-10-15T22:05:32Z","summary":"Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel \u003e= 9","details":"In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects \u003c= v1.19.3, \u003c= v1.18.10, \u003c= v1.17.13, \u003c v1.20.0-alpha2.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubectl"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.19.0"},{"last_affected":"1.19.3"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubectl"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.18.0"},{"last_affected":"1.18.10"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubectl"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.17.0"},{"last_affected":"1.17.13"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubectl"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.20.0"},{"fixed":"1.20.0-alpha2"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/95623"},{"url":"https://www.cve.org/cverecord?id=CVE-2020-8565"}]},{"id":"CVE-2020-8564","modified":"2020-10-15T22:03:19Z","published":"2020-10-15T22:03:19Z","summary":"Docker config secrets leaked when file is malformed and log level \u003e= 4","details":"In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects \u003c v1.19.3, \u003c v1.18.10, \u003c v1.17.13.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubernetes"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.19.0"},{"fixed":"1.19.3"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubernetes"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.18.0"},{"fixed":"1.18.10"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubernetes"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.17.0"},{"fixed":"1.17.13"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/95622"},{"url":"https://www.cve.org/cverecord?id=CVE-2020-8564"}]},{"id":"CVE-2020-8563","modified":"2020-10-15T22:00:44Z","published":"2020-10-15T22:00:44Z","summary":"Secret leaks in kube-controller-manager when using vSphere provider","details":"In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects \u003c v1.19.3.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/controller-manager"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.19.0"},{"fixed":"1.19.3"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/95621"},{"url":"https://www.cve.org/cverecord?id=CVE-2020-8563"}]},{"id":"CVE-2020-8557","modified":"2020-07-13T18:39:08Z","published":"2020-07-13T18:39:08Z","summary":"Node disk DOS by writing to container /etc/hosts","details":"The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"ranges":[{"events":[{"introduced":"1.1.0"},{"fixed":"1.16.13"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"ranges":[{"events":[{"introduced":"1.17.0"},{"fixed":"1.17.9"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"ranges":[{"events":[{"introduced":"1.18.0"},{"fixed":"1.18.6"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/93032"},{"url":"https://www.cve.org/cverecord?id=CVE-2020-8557"}]},{"id":"CVE-2020-8559","modified":"2020-07-08T17:03:16Z","published":"2020-07-08T17:03:16Z","summary":"Privilege escalation from compromised node to cluster","details":"The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.6.0"},{"last_affected":"1.16.12"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.17.0"},{"last_affected":"1.17.8"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.18.0"},{"last_affected":"1.18.5"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/92914"},{"url":"https://www.cve.org/cverecord?id=CVE-2020-8559"}]},{"id":"CVE-2020-8558","modified":"2020-06-19T18:38:58Z","published":"2020-06-19T18:38:58Z","summary":"Node setting allows for neighboring hosts to bypass localhost boundary","details":"The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"ranges":[{"events":[{"introduced":"1.1.0"},{"fixed":"1.16.11"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"ranges":[{"events":[{"introduced":"1.17.0"},{"fixed":"1.17.7"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"ranges":[{"events":[{"introduced":"1.18.0"},{"fixed":"1.18.4"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/92315"},{"url":"https://www.cve.org/cverecord?id=CVE-2020-8558"}]},{"id":"CVE-2020-8555","modified":"2020-05-28T16:13:34Z","published":"2020-05-28T16:13:34Z","summary":"Half-Blind SSRF in kube-controller-manager","details":"The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/controller-manager"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.1.0"},{"fixed":"1.15.12"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/controller-manager"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.16.0"},{"fixed":"1.16.9"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/controller-manager"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.17.0"},{"fixed":"1.17.5"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/controller-manager"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.18.0"},{"last_affected":"1.18.0"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/91542"},{"url":"https://www.cve.org/cverecord?id=CVE-2020-8555"}]},{"id":"CVE-2019-11254","modified":"2020-03-26T18:55:26Z","published":"2020-03-26T18:55:26Z","summary":"kube-apiserver Denial of Service vulnerability from malicious YAML payloads","details":"The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"ranges":[{"events":[{"introduced":"1.1.0"},{"fixed":"1.15.10"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"ranges":[{"events":[{"introduced":"1.16.0"},{"fixed":"1.16.7"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"ranges":[{"events":[{"introduced":"1.17.0"},{"fixed":"1.17.3"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/89535"},{"url":"https://www.cve.org/cverecord?id=CVE-2019-11254"}]},{"id":"CVE-2020-8552","modified":"2020-03-23T18:35:34Z","published":"2020-03-23T18:35:34Z","summary":"apiserver DoS (oom)","details":"The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"ranges":[{"events":[{"introduced":"1.17.0"},{"fixed":"1.17.3"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"ranges":[{"events":[{"introduced":"1.16.0"},{"fixed":"1.16.7"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"ranges":[{"events":[{"introduced":"1.15.0"},{"fixed":"1.15.10"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/89378"},{"url":"https://www.cve.org/cverecord?id=CVE-2020-8552"}]},{"id":"CVE-2020-8551","modified":"2020-03-23T18:34:40Z","published":"2020-03-23T18:34:40Z","summary":"Kubelet DoS via API","details":"The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"ranges":[{"events":[{"introduced":"1.17.0"},{"fixed":"1.17.3"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"ranges":[{"events":[{"introduced":"1.16.0"},{"fixed":"1.16.7"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"ranges":[{"events":[{"introduced":"1.15.0"},{"fixed":"1.15.10"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/89377"},{"url":"https://www.cve.org/cverecord?id=CVE-2020-8551"}]},{"id":"CVE-2019-11251","modified":"2020-02-03T15:12:22Z","published":"2020-02-03T15:12:22Z","summary":"kubectl cp symlink vulnerability","details":"The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubectl"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.1.0"},{"fixed":"1.13.11"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubectl"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.14.0"},{"fixed":"1.14.7"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubectl"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.15.0"},{"fixed":"1.15.4"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/87773"},{"url":"https://www.cve.org/cverecord?id=CVE-2019-11251"}]},{"id":"CVE-2018-1002102","modified":"2019-12-03T22:58:37Z","published":"2019-12-03T22:58:37Z","summary":"Unvalidated redirect","details":"Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.14.0"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/85867"},{"url":"https://www.cve.org/cverecord?id=CVE-2018-1002102"}]},{"id":"CVE-2019-11253","modified":"2019-09-27T16:53:31Z","published":"2019-09-27T16:53:31Z","summary":"Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack","details":"Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"ranges":[{"events":[{"introduced":"1.1.0"},{"fixed":"1.13.12"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"ranges":[{"events":[{"introduced":"1.14.0"},{"fixed":"1.14.8"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"ranges":[{"events":[{"introduced":"1.15.0"},{"fixed":"1.15.5"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"ranges":[{"events":[{"introduced":"1.16.0"},{"fixed":"1.16.2"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/83253"},{"url":"https://www.cve.org/cverecord?id=CVE-2019-11253"}]},{"id":"CVE-2019-11250","modified":"2019-08-08T02:03:04Z","published":"2019-08-08T02:03:04Z","summary":"Bearer tokens are revealed in logs","details":"The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.16.0"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/81114"},{"url":"https://www.cve.org/cverecord?id=CVE-2019-11250"}]},{"id":"CVE-2019-11248","modified":"2019-08-06T14:34:33Z","published":"2019-08-06T14:34:33Z","summary":"/debug/pprof exposed on kubelet's healthz port","details":"The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"ranges":[{"events":[{"introduced":"1.1.0"},{"fixed":"1.12.10"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"ranges":[{"events":[{"introduced":"1.13.0"},{"fixed":"1.13.8"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"ranges":[{"events":[{"introduced":"1.14.0"},{"fixed":"1.14.4"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/81023"},{"url":"https://www.cve.org/cverecord?id=CVE-2019-11248"}]},{"id":"CVE-2019-11249","modified":"2019-08-05T12:44:23Z","published":"2019-08-05T12:44:23Z","summary":"Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal","details":"The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubectl"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.1.0"},{"fixed":"1.13.9"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubectl"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.14.0"},{"fixed":"1.14.5"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubectl"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.15.0"},{"fixed":"1.15.2"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/80984"},{"url":"https://www.cve.org/cverecord?id=CVE-2019-11249"}]},{"id":"CVE-2019-11247","modified":"2019-08-05T12:44:08Z","published":"2019-08-05T12:44:08Z","summary":"API server allows access to custom resources via wrong scope","details":"The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"}],"ranges":[{"events":[{"introduced":"1.7.0"},{"fixed":"1.13.9"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"}],"ranges":[{"events":[{"introduced":"1.14.0"},{"fixed":"1.14.5"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"}],"ranges":[{"events":[{"introduced":"1.15.0"},{"fixed":"1.15.2"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/80983"},{"url":"https://www.cve.org/cverecord?id=CVE-2019-11247"}]},{"id":"CVE-2019-11245","modified":"2019-05-24T16:14:49Z","published":"2019-05-24T16:14:49Z","summary":"container uid changes to root after first restart or if image is already pulled to the node","details":"In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet will run the container as uid 0.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"ranges":[{"events":[{"introduced":"1.13.6"},{"last_affected":"1.13.6"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"ranges":[{"events":[{"introduced":"1.14.2"},{"last_affected":"1.14.2"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/78308"},{"url":"https://www.cve.org/cverecord?id=CVE-2019-11245"}]},{"id":"CVE-2019-11243","modified":"2019-04-18T21:31:53Z","published":"2019-04-18T21:31:53Z","summary":"rest.AnonymousClientConfig() does not remove the serviceaccount credentials from config created by rest.InClusterConfig()","details":"In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubernetes"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.12.0"},{"last_affected":"1.12.4"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubernetes"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"}],"ranges":[{"events":[{"introduced":"1.13.0"},{"last_affected":"1.13.0"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/76797"},{"url":"https://www.cve.org/cverecord?id=CVE-2019-11243"}]},{"id":"CVE-2019-11244","modified":"2019-04-16T20:14:25Z","published":"2019-04-16T20:14:25Z","summary":"`kubectl:-http-cache=\u003cworld-accessible dir\u003e` creates world-writeable cached schema files","details":"In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubectl"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N"}],"ranges":[{"events":[{"introduced":"1.8.0"},{"fixed":"1.15.0"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/76676"},{"url":"https://www.cve.org/cverecord?id=CVE-2019-11244"}]},{"id":"CVE-2019-1002100","modified":"2019-02-25T19:39:09Z","published":"2019-02-25T19:39:09Z","summary":"json-patch requests can exhaust apiserver resources","details":"In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type \"json-patch\" (e.g. `kubectl patch --type json` or `\"Content-Type: application/json-patch+json\"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"ranges":[{"events":[{"introduced":"1.0.0"},{"fixed":"1.11.8"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"ranges":[{"events":[{"introduced":"1.12.0"},{"fixed":"1.12.6"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"ranges":[{"events":[{"introduced":"1.13.0"},{"fixed":"1.13.4"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/74534"},{"url":"https://www.cve.org/cverecord?id=CVE-2019-1002100"}]},{"id":"CVE-2018-1002105","modified":"2018-11-26T11:07:36Z","published":"2018-11-26T11:07:36Z","summary":"proxy request handling in kube-apiserver can leave vulnerable TCP connections","details":"In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.0.0"},{"fixed":"1.10.11"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.11.0"},{"fixed":"1.11.5"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/apiserver"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.12.0"},{"fixed":"1.12.3"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/71411"},{"url":"https://www.cve.org/cverecord?id=CVE-2018-1002105"}]},{"id":"CVE-2018-1002101","modified":"2018-07-03T08:06:15Z","published":"2018-07-03T08:06:15Z","summary":"smb mount security issue","details":"In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubernetes"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.9.0"},{"fixed":"1.9.10"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubernetes"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.10.0"},{"fixed":"1.10.6"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubernetes"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.11.0"},{"fixed":"1.11.2"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/65750"},{"url":"https://www.cve.org/cverecord?id=CVE-2018-1002101"}]},{"id":"CVE-2018-1002100","modified":"2018-03-16T19:24:46Z","published":"2018-03-16T19:24:46Z","summary":"Kubectl copy doesn't check for paths outside of it's destination directory.","details":"In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubectl"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N"}],"ranges":[{"events":[{"introduced":"1.5.0"},{"fixed":"1.9.6"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/61297"},{"url":"https://www.cve.org/cverecord?id=CVE-2018-1002100"}]},{"id":"CVE-2017-1002102","modified":"2018-03-05T20:55:20Z","published":"2018-03-05T20:55:20Z","summary":"atomic writer volume handling allows arbitrary file deletion in host filesystem","details":"In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"}],"ranges":[{"events":[{"introduced":"1.3.0"},{"fixed":"1.7.14"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"}],"ranges":[{"events":[{"introduced":"1.8.0"},{"fixed":"1.8.9"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubelet"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"}],"ranges":[{"events":[{"introduced":"1.9.0"},{"fixed":"1.9.4"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/60814"},{"url":"https://www.cve.org/cverecord?id=CVE-2017-1002102"}]},{"id":"CVE-2017-1002101","modified":"2018-03-05T20:53:58Z","published":"2018-03-05T20:53:58Z","summary":"subpath volume mount handling allows arbitrary file access in host filesystem","details":"In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem.","affected":[{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubernetes"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.3.0"},{"fixed":"1.7.14"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubernetes"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.8.0"},{"fixed":"1.8.9"}]}]},{"package":{"ecosystem":"kubernetes","name":"k8s.io/kubernetes"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"ranges":[{"events":[{"introduced":"1.9.0"},{"fixed":"1.9.4"}]}]}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/60813"},{"url":"https://www.cve.org/cverecord?id=CVE-2017-1002101"}]}]
View Git Blame Copy Permalink