CVE-2021-25735

CVE-2021-25735 利用CVE-2021-25735：绕过Kubernetes验证准入Webhook 设置脆弱环境 让我们先运行脚本gencerts.sh生成TLS证书和密钥。 bash gencerts.sh 要部署准入控制器，你需要本地构建Docker容器镜像，打标签，并使用以下命令将镜像推送到你的Dockerhub。 docker login docker build -t validationwebhook:1.0 . docker tag validationwebhook:1.0 darryk/dev:1.0 docker push darryk/dev:1.0...

Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

Summary A follow-up bypass of the round-4 PodSpec hardening GHSA-gx55-f84r-v3r7, GHSA-wmgg-3p4h-48x7, GHSA-v455-mv2v-5g92. Those advisories validate and sanitize the PodSpec spec.runtime.podSpec / spec.builder.podSpec / function.spec.podSpec, but the Environment CRD also exposes...

Kubernetes SIGs kube-apiserver 安全漏洞

Kubernetes SIGs kube-apiserver is a Kubernetes SIGs open source application. Validate and configure data for api objects, which include containers, services, replication controllers, and more. A security vulnerability exists in Kubernetes SIGs kube-apiserver that allows node updates to bypass a...