Kubernetes
Page 2 of 2 — Kubernetes CVEs from a corpus of 128, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10223 | Medium | 6.5 | 2019-11-05 | A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled anno… |
CVE-2019-11253 | High | 7.5 | 2019-10-17 | Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized us… |
CVE-2019-11250 | Medium | 6.5 | 2019-08-29 | The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or comma… |
CVE-2019-11249 | Medium | 6.5 | 2019-08-29 | The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container t… |
CVE-2019-11248 | High | 8.2 | 2019-08-29 | The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port… |
CVE-2019-11247 | High | 8.1 | 2019-08-29 | The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authoriza… |
CVE-2019-11246 | Medium | 6.5 | 2019-08-29 | The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container t… |
CVE-2019-11245 | Medium | 4.9 | 2019-08-29 | In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the im… |
CVE-2019-11244 | Medium | 5.0 | 2019-04-22 | In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with wo… |
CVE-2019-11243 | High | 8.1 | 2019-04-22 | In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer toke… |
CVE-2019-9946 | High | 7.5 | 2019-04-02 | Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI '… |
CVE-2019-1002101 | Medium | 6.4 | 2019-04-01 | The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the contai… |
CVE-2019-1002100 | Medium | 6.5 | 2019-04-01 | In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a spe… |
CVE-2018-18264 | High | 7.5 | 2019-01-03 | Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. |
CVE-2018-1002105 | Critical | 9.8 | 2018-12-05 | In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver all… |
CVE-2018-1002103 | High | 8.1 | 2018-12-05 | In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to p… |
CVE-2018-1002101 | Medium | 5.9 | 2018-12-05 | In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which… |
CVE-2016-7075 | High | 7.5 | 2018-09-10 | It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker c… |
CVE-2018-1002100 | Medium | 4.2 | 2018-06-02 | In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container… |
CVE-2018-1000400 | High | 8.8 | 2018-05-18 | Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabilities that can res… |
CVE-2017-1002102 | High | 7.1 | 2018-03-13 | In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI… |
CVE-2017-1002101 | High | 8.8 | 2018-03-13 | In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (in… |
CVE-2017-1002100 | Medium | 6.5 | 2017-09-14 | Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which… |
CVE-2015-7561 | Low | 3.1 | 2017-08-07 | Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image. |
CVE-2017-1000056 | Critical | 9.8 | 2017-07-17 | Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any ex… |
CVE-2015-7528 | Medium | 5.3 | 2016-04-11 | Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name. |
CVE-2016-1906 | Critical | 9.8 | 2016-02-03 | Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed. |
CVE-2016-1905 | High | 7.7 | 2016-02-03 | The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted pa… |