Lucene search

K
osvGoogleOSV:GHSA-WQWF-X5CJ-RG56
HistoryFeb 15, 2022 - 1:57 a.m.

Kubernetes Arbitrary Command Injection

2022-02-1501:57:18
Google
osv.dev
4

9.6 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.6%

In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection.

Specific Go Packages Affected

k8s.io/kubernetes/pkg/util/mount

9.6 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.6%