Vulnerabilities > CVE-2017-1002102 - Unspecified vulnerability in Kubernetes

047910
CVSS 5.6 - MEDIUM
Attack vector
LOCAL
Attack complexity
HIGH
Privileges required
LOW
Confidentiality impact
NONE
Integrity impact
HIGH
Availability impact
NONE
local
high complexity
kubernetes
nessus
NVD
Published: 2018-03-13
Updated: 2024-11-21

Summary

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.

Vulnerable Configurations

Part Description Count
Application
Kubernetes
283

Nessus

  • NASL familyMisc.
    NASL idKUBERNETES_1_9_4_MULTIPLE_VULNERABILITIES.NASL
    descriptionThe version of Kubernetes installed on the remote host is version 1.3.x prior to 1.7.14, 1.8.x prior to 1.8.9 or 1.9.x prior to 1.9.4. It is, therefore, affected by multiple vulnerabilities. - An arbitrary file access vulnerability exists in containers using subpath volume mounts. An authenticated, local attacker can exploit this to access arbitrary files or directories including the host
    last seen2020-06-01
    modified2020-06-02
    plugin id124590
    published2019-05-03
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124590
    titleKubernetes 1.3.x < 1.7.14 / 1.8.x < 1.8.9 / 1.9.x < 1.9.4 multiple vulnerabilities
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2018-0475.NASL
    descriptionAn update is now available for Red Hat OpenShift Container Platform 3.7, 3.6, 3.5, 3.4, and 3.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. OpenShift Container Platform by Red Hat is the company
    last seen2020-06-12
    modified2018-12-04
    plugin id119391
    published2018-12-04
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119391
    titleRHEL 7 : Red Hat OpenShift Container Platform (RHSA-2018:0475)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2018-4061.NASL
    descriptionDescription of changes: [1.9.1-2.1.5] - Production built 1.9.1-2.1.5 - Fix the upgrade version check - Remove w/a from [Orabug 27125915] [1.9.1-2.1.4.dev] - Make sure worker node upgrade properly - [Orabug 27649898] [1.9.1-2.1.3.dev] - Ensure that the runtime mounts RO volumes read-only [CVE-2017-1002102] - Update Dashboard version to v1.8.3 [CVE-2017-1002102] - Fix nested volume mounts for read-only API data volumes [CVE-2017-1002102] - Fixed kubeadm-setup.sh and kubeadm-registry.sh - Add feature gate for subpath [CVE-2017-1002101] - Add subpath e2e tests [CVE-2017-1002101] - Lock subPath volumes [CVE-2017-1002101]
    last seen2020-06-01
    modified2020-06-02
    plugin id108939
    published2018-04-10
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108939
    titleOracle Linux 7 : kubernetes (ELSA-2018-4061)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-2BFBD27A0B.NASL
    description - Rebase to 3.9 - Security fix for CVE-2017-1002101 and CVE-2017-1002102 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2019-01-03
    plugin id120316
    published2019-01-03
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/120316
    titleFedora 28 : origin (2018-2bfbd27a0b)

Redhat

advisories
rhsa
idRHSA-2018:0475
rpms
  • atomic-openshift-0:3.3.1.46.11-1.git.4.e236015.el7
  • atomic-openshift-0:3.4.1.44.38-1.git.4.bb8df08.el7
  • atomic-openshift-0:3.5.5.31.48-1.git.4.ff6153e.el7
  • atomic-openshift-0:3.6.173.0.96-1.git.4.e6301f8.el7
  • atomic-openshift-0:3.7.23-1.git.5.83efd71.el7
  • atomic-openshift-clients-0:3.3.1.46.11-1.git.4.e236015.el7
  • atomic-openshift-clients-0:3.4.1.44.38-1.git.4.bb8df08.el7
  • atomic-openshift-clients-0:3.5.5.31.48-1.git.4.ff6153e.el7
  • atomic-openshift-clients-0:3.6.173.0.96-1.git.4.e6301f8.el7
  • atomic-openshift-clients-0:3.7.23-1.git.5.83efd71.el7
  • atomic-openshift-clients-redistributable-0:3.3.1.46.11-1.git.4.e236015.el7
  • atomic-openshift-clients-redistributable-0:3.4.1.44.38-1.git.4.bb8df08.el7
  • atomic-openshift-clients-redistributable-0:3.5.5.31.48-1.git.4.ff6153e.el7
  • atomic-openshift-clients-redistributable-0:3.6.173.0.96-1.git.4.e6301f8.el7
  • atomic-openshift-clients-redistributable-0:3.7.23-1.git.5.83efd71.el7
  • atomic-openshift-cluster-capacity-0:3.6.173.0.96-1.git.4.e6301f8.el7
  • atomic-openshift-cluster-capacity-0:3.7.23-1.git.5.83efd71.el7
  • atomic-openshift-docker-excluder-0:3.3.1.46.11-1.git.4.e236015.el7
  • atomic-openshift-docker-excluder-0:3.4.1.44.38-1.git.4.bb8df08.el7
  • atomic-openshift-docker-excluder-0:3.5.5.31.48-1.git.4.ff6153e.el7
  • atomic-openshift-docker-excluder-0:3.6.173.0.96-1.git.4.e6301f8.el7
  • atomic-openshift-docker-excluder-0:3.7.23-1.git.5.83efd71.el7
  • atomic-openshift-dockerregistry-0:3.3.1.46.11-1.git.4.e236015.el7
  • atomic-openshift-dockerregistry-0:3.4.1.44.38-1.git.4.bb8df08.el7
  • atomic-openshift-dockerregistry-0:3.5.5.31.48-1.git.4.ff6153e.el7
  • atomic-openshift-dockerregistry-0:3.6.173.0.96-1.git.4.e6301f8.el7
  • atomic-openshift-dockerregistry-0:3.7.23-1.git.5.83efd71.el7
  • atomic-openshift-excluder-0:3.3.1.46.11-1.git.4.e236015.el7
  • atomic-openshift-excluder-0:3.4.1.44.38-1.git.4.bb8df08.el7
  • atomic-openshift-excluder-0:3.5.5.31.48-1.git.4.ff6153e.el7
  • atomic-openshift-excluder-0:3.6.173.0.96-1.git.4.e6301f8.el7
  • atomic-openshift-excluder-0:3.7.23-1.git.5.83efd71.el7
  • atomic-openshift-federation-services-0:3.6.173.0.96-1.git.4.e6301f8.el7
  • atomic-openshift-federation-services-0:3.7.23-1.git.5.83efd71.el7
  • atomic-openshift-master-0:3.3.1.46.11-1.git.4.e236015.el7
  • atomic-openshift-master-0:3.4.1.44.38-1.git.4.bb8df08.el7
  • atomic-openshift-master-0:3.5.5.31.48-1.git.4.ff6153e.el7
  • atomic-openshift-master-0:3.6.173.0.96-1.git.4.e6301f8.el7
  • atomic-openshift-master-0:3.7.23-1.git.5.83efd71.el7
  • atomic-openshift-node-0:3.3.1.46.11-1.git.4.e236015.el7
  • atomic-openshift-node-0:3.4.1.44.38-1.git.4.bb8df08.el7
  • atomic-openshift-node-0:3.5.5.31.48-1.git.4.ff6153e.el7
  • atomic-openshift-node-0:3.6.173.0.96-1.git.4.e6301f8.el7
  • atomic-openshift-node-0:3.7.23-1.git.5.83efd71.el7
  • atomic-openshift-pod-0:3.3.1.46.11-1.git.4.e236015.el7
  • atomic-openshift-pod-0:3.4.1.44.38-1.git.4.bb8df08.el7
  • atomic-openshift-pod-0:3.5.5.31.48-1.git.4.ff6153e.el7
  • atomic-openshift-pod-0:3.6.173.0.96-1.git.4.e6301f8.el7
  • atomic-openshift-pod-0:3.7.23-1.git.5.83efd71.el7
  • atomic-openshift-sdn-ovs-0:3.3.1.46.11-1.git.4.e236015.el7
  • atomic-openshift-sdn-ovs-0:3.4.1.44.38-1.git.4.bb8df08.el7
  • atomic-openshift-sdn-ovs-0:3.5.5.31.48-1.git.4.ff6153e.el7
  • atomic-openshift-sdn-ovs-0:3.6.173.0.96-1.git.4.e6301f8.el7
  • atomic-openshift-sdn-ovs-0:3.7.23-1.git.5.83efd71.el7
  • atomic-openshift-service-catalog-0:3.6.173.0.96-1.git.4.e6301f8.el7
  • atomic-openshift-service-catalog-0:3.7.23-1.git.5.83efd71.el7
  • atomic-openshift-template-service-broker-0:3.7.23-1.git.5.83efd71.el7
  • atomic-openshift-tests-0:3.3.1.46.11-1.git.4.e236015.el7
  • atomic-openshift-tests-0:3.4.1.44.38-1.git.4.bb8df08.el7
  • atomic-openshift-tests-0:3.5.5.31.48-1.git.4.ff6153e.el7
  • atomic-openshift-tests-0:3.6.173.0.96-1.git.4.e6301f8.el7
  • atomic-openshift-tests-0:3.7.23-1.git.5.83efd71.el7
  • tuned-profiles-atomic-openshift-node-0:3.3.1.46.11-1.git.4.e236015.el7
  • tuned-profiles-atomic-openshift-node-0:3.4.1.44.38-1.git.4.bb8df08.el7
  • tuned-profiles-atomic-openshift-node-0:3.5.5.31.48-1.git.4.ff6153e.el7
  • tuned-profiles-atomic-openshift-node-0:3.6.173.0.96-1.git.4.e6301f8.el7
  • tuned-profiles-atomic-openshift-node-0:3.7.23-1.git.5.83efd71.el7

References