Design/Logic Flaw

An issue was discovered in Rancher 2 through 2.1.5. Any project member with access to the default namespace can mount the netes-default service account in a pod, and then use that pod to execute administrative privileged commands against the k8s cluster. This could be mitigated by isolating the...

CVE-2018-20321

This CVE (CVE-2018-20321) affects Rancher 2.x (through 2.1.5). A project member with access to the default namespace can mount the kubernetes default service account in a pod and use it to run privileged commands against the Kubernetes cluster. The documented mitigation is to isolate the default ...

PT-2019-10045 · Rancher · Rancher

Name of the Vulnerable Software and Affected Versions: Rancher versions 2.0.0 through 2.1.5 Description: An issue allows project members with access to the default namespace to execute administrative privileged commands against the k8s cluster by mounting the netes-default service account in a po...

kubernetes: Mishandling of symlinks allows for arbitrary file write via `kubectl cp`

A flaw was found in Kubernetes via the mishandling of symlinks when copying files from a running container. An attacker could exploit this by convincing a user to use kubectl cp or oc cp with a malicious container, allowing for arbitrary files to be overwritten on the host machine...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a CNI security vulnerability

Summary IBM Cloud Kubernetes Service is affected by a CNI security vulnerability which could result in weaker than expected security. Vulnerability Details CVE-ID: CVE-2019-9946 Description: Kubernetes could provide weaker than expected security, caused by an interaction when paired with the...

kubernetes: Mishandling of symlinks allows for arbitrary file write via `kubectl cp`

A flaw was found in Kubernetes via the mishandling of symlinks when copying files from a running container. An attacker could exploit this by convincing a user to use kubectl cp or oc cp with a malicious container, allowing for arbitrary files to be overwritten on the host machine...

Moderate: Red Hat Bug Fix Advisory: OpenShift Container Platform 3.9 bug fix update

Red Hat OpenShift Container Platform release 3.9.74 is now available with updates to packages and images that fix several bugs. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This...

DefectDojo v1.5.4 - Application Vulnerability Correlation And Security Orchestration Application

DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, schedule scans, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one...

Kubernetes 1.x < 1.11.8 / 1.12.x < 1.12.6 / 1.13.x < 1.13.4 API server DOS

The version of Kubernetes installed on the remote host is version 1.x prior to 1.11.8, 1.12.x prior to 1.12.6 or 1.13.x prior to 1.13.4. It is, therefore, affected by a denial of service vulnerability in the API server. An authenticated, remote attacker can exploit this via a specially crafted...

Google Kubernetes CNI Portmap Plugin Remote Vulnerability

Google Kubernetes is an open source Docker container cluster management system from Google. The system provides resource scheduling , deployment and operation , service discovery and expansion and contraction for containerized applications.CNI Portmap Plugin is one of the plugins. A security...

Security Bulletin: API Connect V2018 is impacted by vulnerability in the Kubernetes API server (CVE-2019-1002100)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-1002100 DESCRIPTION: The Kubernetes API server is vulnerable to a denial of service. By sending a specially crafted patch of type "json-patch" requests, a remote authenticated attacker could...

Exploit for Link Following in Kubernetes

kubectlcpCVE-2019-1002101 PoC helper scripts and Dockerfile...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2019-2.0-0148

An update of 'kubernetes' packages of Photon OS has been released...

Important Photon OS Security Update - PHSA-2019-0148

Updates of 'kubernetes' packages of Photon OS have been released...

kubectl path traversal vulnerability

kubectl is a command line program for running commands against a Kubernetes cluster. A path traversal vulnerability exists in kubectl that stems from a failure of a networked system or product to properly filter special elements in the path of a resource or file, which can be exploited by an...

CVE-2019-9946

Cloud Native Computing Foundation CNCF CNI Container Networking Interface 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE-...

DEBIAN-CVE-2019-9946

Cloud Native Computing Foundation CNCF CNI Container Networking Interface 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE-...

CVE-2019-9946

Cloud Native Computing Foundation CNCF CNI Container Networking Interface 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE-...

CVE-2019-9946

Cloud Native Computing Foundation CNCF CNI Container Networking Interface 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE-...

Code injection

Cloud Native Computing Foundation CNCF CNI Container Networking Interface 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE-...