GHSA-27wf-5967-98gx

Kubernetes kubelet arbitrary command execution

Source: GitHub Advisory Database (reviewed) High CVE-2024-10220

Packages

Ecosystem	Package	Affected	Fixed in
Go	k8s.io/kubernetes	< 1.28.12	1.28.12
Go	k8s.io/kubernetes	>= 1.29.0, < 1.29.7	1.29.7
Go	k8s.io/kubernetes	>= 1.30.0, < 1.30.3	1.30.3

Details

As written in the advisory (Markdown source, shown as plain text).

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-10220 advisory
https://github.com/kubernetes/kubernetes/issues/128885 web
https://github.com/kubernetes/kubernetes/commit/1ab06efe92d8e898ca1931471c9533ce94aba29b web
https://github.com/kubernetes/kubernetes package
https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko web
https://pkg.go.dev/vuln/GO-2024-3286 web
http://www.openwall.com/lists/oss-security/2024/11/20/1 web