Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2017-1002101

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privilege

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
kubernetes

Description

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Kubernetes Kubernetes

  • v1.3.xaffected
  • v1.4.xaffected
  • v1.5.xaffected
  • v1.6.xaffected
  • unspecified to < v1.7.14affected
  • unspecified to < v1.8.9affected
  • unspecified to < v1.9.4affected

References