Lucene search

K
osvGoogleOSV:GO-2022-0701
HistoryFeb 15, 2022 - 1:57 a.m.

Directory traversal in k8s.io/kubernetes

2022-02-1501:57:18
Google
osv.dev
13
directory traversal
crafted object names
kubernetes
etcd
red hat openshift enterprise 3.0

AI Score

6.2

Confidence

Low

EPSS

0.001

Percentile

41.5%

Crafted object type names can cause directory traversal in Kubernetes.

Object names are not validated before being passed to etcd. This allows attackers to write arbitrary files via a crafted object name, hence causing directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0.

AI Score

6.2

Confidence

Low

EPSS

0.001

Percentile

41.5%