GO-2022-0701

vendorUSosv

Directory traversal in k8s.io/kubernetes

view advisory published 2022-02-15Licence: per source

Crafted object type names can cause directory traversal in Kubernetes. Object names are not validated before being passed to etcd. This allows attackers to write arbitrary files via a crafted object name, hence causing directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2015-5305US	medium6.4	1.85% (79th)	—	2015-11-06
Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is…

references

External citations — patches, advisories, analysis.

https://github.com/kubernetes/kubernetes/commit/37f730f68c7f06e060f90714439bfb0dbb2df5e7FIX
https://github.com/kubernetes/kubernetes/pull/16381FIX

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan