Vulnerabilities > CVE-2017-1002102 - Unspecified vulnerability in Kubernetes
Attack vector
LOCAL Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
NONE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.
Vulnerable Configurations
Nessus
NASL family Misc. NASL id KUBERNETES_1_9_4_MULTIPLE_VULNERABILITIES.NASL description The version of Kubernetes installed on the remote host is version 1.3.x prior to 1.7.14, 1.8.x prior to 1.8.9 or 1.9.x prior to 1.9.4. It is, therefore, affected by multiple vulnerabilities. - An arbitrary file access vulnerability exists in containers using subpath volume mounts. An authenticated, local attacker can exploit this to access arbitrary files or directories including the host last seen 2020-06-01 modified 2020-06-02 plugin id 124590 published 2019-05-03 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124590 title Kubernetes 1.3.x < 1.7.14 / 1.8.x < 1.8.9 / 1.9.x < 1.9.4 multiple vulnerabilities NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2018-0475.NASL description An update is now available for Red Hat OpenShift Container Platform 3.7, 3.6, 3.5, 3.4, and 3.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. OpenShift Container Platform by Red Hat is the company last seen 2020-06-12 modified 2018-12-04 plugin id 119391 published 2018-12-04 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/119391 title RHEL 7 : Red Hat OpenShift Container Platform (RHSA-2018:0475) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2018-4061.NASL description Description of changes: [1.9.1-2.1.5] - Production built 1.9.1-2.1.5 - Fix the upgrade version check - Remove w/a from [Orabug 27125915] [1.9.1-2.1.4.dev] - Make sure worker node upgrade properly - [Orabug 27649898] [1.9.1-2.1.3.dev] - Ensure that the runtime mounts RO volumes read-only [CVE-2017-1002102] - Update Dashboard version to v1.8.3 [CVE-2017-1002102] - Fix nested volume mounts for read-only API data volumes [CVE-2017-1002102] - Fixed kubeadm-setup.sh and kubeadm-registry.sh - Add feature gate for subpath [CVE-2017-1002101] - Add subpath e2e tests [CVE-2017-1002101] - Lock subPath volumes [CVE-2017-1002101] last seen 2020-06-01 modified 2020-06-02 plugin id 108939 published 2018-04-10 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/108939 title Oracle Linux 7 : kubernetes (ELSA-2018-4061) NASL family Fedora Local Security Checks NASL id FEDORA_2018-2BFBD27A0B.NASL description - Rebase to 3.9 - Security fix for CVE-2017-1002101 and CVE-2017-1002102 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2019-01-03 plugin id 120316 published 2019-01-03 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/120316 title Fedora 28 : origin (2018-2bfbd27a0b)
Redhat
| advisories |
| ||||
| rpms |
|