CVE-2017-1002102

State: PUBLISHED · Published: 2018-03-13 · Updated: 2024-08-05 · Assigner: kubernetes

Description

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.

CWE

(none)

Affected

Kubernetes / Kubernetes — v=v1.3.x [affected]; v=v1.4.x [affected]; v=v1.5.x [affected]; v=v1.6.x [affected]; v=unspecified <v1.7.14 [affected]; v=unspecified <v1.8.9 [affected]; v=unspecified <v1.9.4 [affected]

CVSS

3.0 score=7.1 severity=HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

References

https://access.redhat.com/errata/RHSA-2018:0475 vendor-advisory, x_refsource_REDHAT
https://github.com/kubernetes/kubernetes/issues/60814 x_refsource_CONFIRM

Source

cvelistV5-main/cves/2017/1002xxx/CVE-2017-1002102.json