GHSA-mm7g-f2gg-cw8g
Kubernetes arbitrary file overwrite
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | k8s.io/kubernetes | >= 1.3.0, < 1.7.14 | 1.7.14 |
| Go | k8s.io/kubernetes | >= 1.8.0, < 1.8.9 | 1.8.9 |
| Go | k8s.io/kubernetes | >= 1.9.0, < 1.9.4 | 1.9.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.
References
External links from the advisory. They lead to third-party sites.