Arbitrary Command Execution

🗓️ 09 Dec 2024 04:07:36Reported by Veracode Vulnerability DatabaseType

Kubernetes is vulnerable to Arbitrary Command Execution due to improper gitRepo volume handling.

Reporter	Title	Published	Views	Family All 66
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Kubernetes kubelet (CVE-2024-10220)	28 Mar 202522:00	–	ibm
Tenable Nessus	Azure Linux 3.0 Security Update: kubernetes (CVE-2024-10220)	10 Feb 202500:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: kubernetes (CVE-2024-10220)	16 Jan 202500:00	–	nessus
Tenable Nessus	Photon OS 4.0: Kubernetes PHSA-2025-4.0-0769	20 Mar 202500:00	–	nessus
Tenable Nessus	Photon OS 5.0: Kubernetes PHSA-2025-5.0-0487	21 Mar 202500:00	–	nessus
Tenable Nessus	TencentOS Server 4: kubernetes (TSSA-2024:1093)	16 Jun 202500:00	–	nessus
Tenable Nessus	Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-017390)	9 May 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2024-10220	5 Mar 202500:00	–	nessus
BDU FSTEC	The vulnerability of the Kubernetes cluster management software lies in the incorrect path name limitation for the restricted access directory, allowing arbitrary code to be executed.	21 Nov 202400:00	–	bdu_fstec

Vulners

Node

kubernetes k8s.io/kubernetesRangev1.29.0-alpha.0–1.29.0-alpha.0go

kubernetes k8s.io/kubernetesRangev1.30.0-alpha.0–1.30.0-alpha.0go

Source	Link
github	www.github.com/kubernetes/kubernetes/commit/1ab06efe92d8e898ca1931471c9533ce94aba29b
github	www.github.com/kubernetes/kubernetes/issues/128885
github	www.github.com/advisories/GHSA-27wf-5967-98gx
groups	www.groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko
openwall	www.openwall.com/lists/oss-security/2024/11/20/1

09 Dec 2024 13:01Current

7.5High risk

Vulners AI Score7.5

CVSS 3.18.1

EPSS0.39569

SSVC