Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in k8s.io/kubernetes: GHSA-27wf-5967-98gx #3286

Closed
GoVulnBot opened this issue Nov 22, 2024 · 2 comments
Closed

x/vulndb: potential Go vuln in k8s.io/kubernetes: GHSA-27wf-5967-98gx #3286

GoVulnBot opened this issue Nov 22, 2024 · 2 comments
Labels
triaged

Comments

@GoVulnBot
Copy link

Advisory GHSA-27wf-5967-98gx references a vulnerability in the following Go modules:

Module
k8s.io/kubernetes

Description:
The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: k8s.io/kubernetes
      versions:
        - fixed: 1.28.12
        - introduced: 1.29.0
        - fixed: 1.29.7
        - introduced: 1.30.0
        - fixed: 1.30.3
      vulnerable_at: 1.30.2
summary: Kubernetes kubelet arbitrary command execution in k8s.io/kubernetes
cves:
    - CVE-2024-10220
ghsas:
    - GHSA-27wf-5967-98gx
references:
    - advisory: https://github.com/advisories/GHSA-27wf-5967-98gx
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-10220
    - fix: https://github.com/kubernetes/kubernetes/commit/1ab06efe92d8e898ca1931471c9533ce94aba29b
    - report: https://github.com/kubernetes/kubernetes/issues/128885
    - web: http://www.openwall.com/lists/oss-security/2024/11/20/1
    - web: https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko
source:
    id: GHSA-27wf-5967-98gx
    created: 2024-11-22T23:01:23.120211955Z
review_status: UNREVIEWED
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/632255 mentions this issue: data/reports: add 7 unreviewed reports

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/635759 mentions this issue: data/reports: review GO-2024-3286

gopherbot pushed a commit that referenced this issue Dec 13, 2024
@tatianab @gopherbot
data/reports: review GO-2024-3286
06de138 
  - data/reports/GO-2024-3286.yaml

Fixes #3286
Updates #3301

Change-Id: I9530c44251daaa221d883403800779477cd929de
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/635759
LUCI-TryBot-Result: Go LUCI <[email protected]>
Reviewed-by: Damien Neil <[email protected]>
Auto-Submit: Tatiana Bradley <[email protected]>
@GoVulnBot GoVulnBot mentioned this issue Feb 13, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@tatianab @gopherbot @GoVulnBot