Skip to content

x/vulndb: potential Go vuln in k8s.io/kubernetes: GHSA-mm7g-f2gg-cw8g #1977

New issue
New issue
Closed
Closed
x/vulndb: potential Go vuln in k8s.io/kubernetes: GHSA-mm7g-f2gg-cw8g#1977
Assignees
neild
Labels
excluded: EFFECTIVELY_PRIVATEThis vulnerability exists in a package can be imported, but isn't meant to be outside that module.
@GoVulnBot

Description

@GoVulnBot
GoVulnBot
opened on Jul 26, 2023

In GitHub Security Advisory GHSA-mm7g-f2gg-cw8g, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
k8s.io/kubernetes >= 1.9.0, <= 1.9.3

Cross references:

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: k8s.io/kubernetes
      versions:
        - introduced: TODO (earliest fixed "", vuln range ">= 1.9.0, <= 1.9.3")
      vulnerable_at: 1.27.4
      packages:
        - package: k8s.io/kubernetes
    - module: k8s.io/kubernetes
      versions:
        - introduced: TODO (earliest fixed "", vuln range ">= 1.8.0, <= 1.8.8")
      vulnerable_at: 1.27.4
      packages:
        - package: k8s.io/kubernetes
    - module: k8s.io/kubernetes
      versions:
        - introduced: TODO (earliest fixed "", vuln range ">= 1.7.0, <= 1.7.13")
      vulnerable_at: 1.27.4
      packages:
        - package: k8s.io/kubernetes
    - module: k8s.io/kubernetes
      versions:
        - introduced: TODO (earliest fixed "", vuln range ">= 1.3, < 1.7")
      vulnerable_at: 1.27.4
      packages:
        - package: k8s.io/kubernetes
summary: Kubernetes arbitrary file overwrite
description: |-
    In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14,
    1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI
    volume can trigger deletion of arbitrary files/directories from the nodes where
    they are running.
cves:
    - CVE-2017-1002102
ghsas:
    - GHSA-mm7g-f2gg-cw8g
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2017-1002102
    - report: https://github.com/kubernetes/kubernetes/issues/60814
    - web: https://access.redhat.com/errata/RHSA-2018:0475
    - advisory: https://github.com/advisories/GHSA-mm7g-f2gg-cw8g

Metadata

Metadata

Assignees

Labels

excluded: EFFECTIVELY_PRIVATEThis vulnerability exists in a package can be imported, but isn't meant to be outside that module.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions