9440 matches found
Remote Code Execution (RCE)
github.com/kubernetes/dns leverages the dnsmasq library which is vulnerable to a heap-based buffer overflow. An attacker could cause a denial of service or execute arbitrary code via crafted DNS response. This issue in dnsmasq has been assigned CVE-2017-14491...
SUSE-SU-2017:2676-1 Security update for Salt
This update for salt fixes one security issue and bugs: The following security issue has been fixed: - CVE-2017-12791: Directory traversal vulnerability in minion id validation allowed remote minions with incorrect credentials to authenticate to a master via a crafted minion ID bsc1053955...
SUSE-SU-2017:2674-1 Security update for Salt
This update for salt fixes one security issue and bugs: The following security issue has been fixed: - CVE-2017-12791: Directory traversal vulnerability in minion id validation allowed remote minions with incorrect credentials to authenticate to a master via a crafted minion ID bsc1053955...
SUSE-SU-2017:2666-1 Security update for salt
This update for salt fixes one security issue and bugs. The following security issue has been fixed: - CVE-2017-12791: Directory traversal vulnerability in minion id validation allowed remote minions with incorrect credentials to authenticate to a master via a crafted minion ID bsc1053955...
Kubebot: A Kubernetes Based Security Testing Slackbot
PenTestIT RSS Feed About a week ago, I blogged about List of Portable Hardware Devices for Penetration Testing. The tool that I am blogging about today - Kubebot - can be an awesome example and be installed very easily on a Raspberry Pi that you have lying around. Best part is that this is open...
Important: Red Hat Security Advisory: Red Hat Mobile Application Platform security update
An update is now available for Red Hat Mobile Application Platform 4.5. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
Google Kubernetes Information Disclosure Vulnerability
Google Kubernetes is an open source Docker container cluster management system from Google, Inc. The system provides resource scheduling, deployment and operation, service discovery and scaling up and down for containerized applications. A security vulnerability exists in Google Kubernetes, which...
CVE-2017-1002100
Default access permissions for Persistent Volumes PVs created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the...
Authorization Bypass
kubernetes/kubernetes is vulnerable to authorization bypass. The library misconfigures the permissions required for access to a URI, allowing a malicious user to unauthorized access to the URI through the internet...
CVE-2017-1002100
Default access permissions for Persistent Volumes PVs created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the...
CVE-2017-1002100
Default access permissions for Persistent Volumes PVs created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the...
Default credentials
Default access permissions for Persistent Volumes PVs created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the...
CVE-2017-1002100
CVE-2017-1002100 concerns default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider (versions 1.6.0–1.6.5). The issue is that PVs are configured with the container access mode, exposing a URI on the public internet without requiring authentication. Acc...
CVE-2017-1002100
Default access permissions for Persistent Volumes PVs created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the...
CVE-2017-1002100
Default access permissions for Persistent Volumes PVs created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the...
CVE-2017-1000056
Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object...
Unauthorized Image Loading
github.com/kubernetes/kubernetes is vulnerable to unauthorized image loading. A malicious user can use the private images of another user if they know the name of the image...
Red Hat OpenShift3 Kubernetes Sensitive Information Disclosure Vulnerability
Red Hat OpenShift3 is a Platform-as-a-Service PaaS cloud computing platform that builds, tests, deploys and runs applications. A security vulnerability in Red Hat OpenShift3 Kubernetes allows remote attackers to exploit the vulnerability by submitting a special request to access images that are...