Patchwire CVEs, their patch status, and feeds to follow them

CVE-2017-1002101

Fixed in a distro release EPSS 13%CVSS 8.8

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem.

Published 2018-03-13 · CVE record · OSV

Products: Kubernetes

Distro releases

ReleasePackageFixed in
Debian:12kubernetes1.7.16+dfsg-1
Debian:13kubernetes1.7.16+dfsg-1
Debian:14kubernetes1.7.16+dfsg-1
Red Hat:openshift:3.3atomic-openshift0:3.3.1.46.11-1.git.4.e236015.el7
Red Hat:openshift:3.3atomic-openshift-clients0:3.3.1.46.11-1.git.4.e236015.el7
Red Hat:openshift:3.3atomic-openshift-clients-redistributable0:3.3.1.46.11-1.git.4.e236015.el7
Red Hat:openshift:3.3atomic-openshift-docker-excluder0:3.3.1.46.11-1.git.4.e236015.el7
Red Hat:openshift:3.3atomic-openshift-dockerregistry0:3.3.1.46.11-1.git.4.e236015.el7
Red Hat:openshift:3.3atomic-openshift-excluder0:3.3.1.46.11-1.git.4.e236015.el7
Red Hat:openshift:3.3atomic-openshift-master0:3.3.1.46.11-1.git.4.e236015.el7
Red Hat:openshift:3.3atomic-openshift-node0:3.3.1.46.11-1.git.4.e236015.el7
Red Hat:openshift:3.3atomic-openshift-pod0:3.3.1.46.11-1.git.4.e236015.el7
Red Hat:openshift:3.3atomic-openshift-sdn-ovs0:3.3.1.46.11-1.git.4.e236015.el7
Red Hat:openshift:3.3atomic-openshift-tests0:3.3.1.46.11-1.git.4.e236015.el7
Red Hat:openshift:3.3tuned-profiles-atomic-openshift-node0:3.3.1.46.11-1.git.4.e236015.el7
Red Hat:openshift:3.4atomic-openshift0:3.4.1.44.38-1.git.4.bb8df08.el7
Red Hat:openshift:3.4atomic-openshift-clients0:3.4.1.44.38-1.git.4.bb8df08.el7
Red Hat:openshift:3.4atomic-openshift-clients-redistributable0:3.4.1.44.38-1.git.4.bb8df08.el7
Red Hat:openshift:3.4atomic-openshift-docker-excluder0:3.4.1.44.38-1.git.4.bb8df08.el7
Red Hat:openshift:3.4atomic-openshift-dockerregistry0:3.4.1.44.38-1.git.4.bb8df08.el7
Red Hat:openshift:3.4atomic-openshift-excluder0:3.4.1.44.38-1.git.4.bb8df08.el7
Red Hat:openshift:3.4atomic-openshift-master0:3.4.1.44.38-1.git.4.bb8df08.el7
Red Hat:openshift:3.4atomic-openshift-node0:3.4.1.44.38-1.git.4.bb8df08.el7
Red Hat:openshift:3.4atomic-openshift-pod0:3.4.1.44.38-1.git.4.bb8df08.el7
Red Hat:openshift:3.4atomic-openshift-sdn-ovs0:3.4.1.44.38-1.git.4.bb8df08.el7
Red Hat:openshift:3.4atomic-openshift-tests0:3.4.1.44.38-1.git.4.bb8df08.el7
Red Hat:openshift:3.4tuned-profiles-atomic-openshift-node0:3.4.1.44.38-1.git.4.bb8df08.el7
Red Hat:openshift:3.5atomic-openshift0:3.5.5.31.48-1.git.4.ff6153e.el7
Red Hat:openshift:3.5atomic-openshift-clients0:3.5.5.31.48-1.git.4.ff6153e.el7
Red Hat:openshift:3.5atomic-openshift-clients-redistributable0:3.5.5.31.48-1.git.4.ff6153e.el7
Red Hat:openshift:3.5atomic-openshift-docker-excluder0:3.5.5.31.48-1.git.4.ff6153e.el7
Red Hat:openshift:3.5atomic-openshift-dockerregistry0:3.5.5.31.48-1.git.4.ff6153e.el7
Red Hat:openshift:3.5atomic-openshift-excluder0:3.5.5.31.48-1.git.4.ff6153e.el7
Red Hat:openshift:3.5atomic-openshift-master0:3.5.5.31.48-1.git.4.ff6153e.el7
Red Hat:openshift:3.5atomic-openshift-node0:3.5.5.31.48-1.git.4.ff6153e.el7
Red Hat:openshift:3.5atomic-openshift-pod0:3.5.5.31.48-1.git.4.ff6153e.el7
Red Hat:openshift:3.5atomic-openshift-sdn-ovs0:3.5.5.31.48-1.git.4.ff6153e.el7
Red Hat:openshift:3.5atomic-openshift-tests0:3.5.5.31.48-1.git.4.ff6153e.el7
Red Hat:openshift:3.5tuned-profiles-atomic-openshift-node0:3.5.5.31.48-1.git.4.ff6153e.el7
Red Hat:openshift:3.6atomic-openshift0:3.6.173.0.96-1.git.4.e6301f8.el7
Red Hat:openshift:3.6atomic-openshift-clients0:3.6.173.0.96-1.git.4.e6301f8.el7
Red Hat:openshift:3.6atomic-openshift-clients-redistributable0:3.6.173.0.96-1.git.4.e6301f8.el7
Red Hat:openshift:3.6atomic-openshift-cluster-capacity0:3.6.173.0.96-1.git.4.e6301f8.el7
Red Hat:openshift:3.6atomic-openshift-docker-excluder0:3.6.173.0.96-1.git.4.e6301f8.el7
Red Hat:openshift:3.6atomic-openshift-dockerregistry0:3.6.173.0.96-1.git.4.e6301f8.el7
Red Hat:openshift:3.6atomic-openshift-excluder0:3.6.173.0.96-1.git.4.e6301f8.el7
Red Hat:openshift:3.6atomic-openshift-federation-services0:3.6.173.0.96-1.git.4.e6301f8.el7
Red Hat:openshift:3.6atomic-openshift-master0:3.6.173.0.96-1.git.4.e6301f8.el7
Red Hat:openshift:3.6atomic-openshift-node0:3.6.173.0.96-1.git.4.e6301f8.el7
Red Hat:openshift:3.6atomic-openshift-pod0:3.6.173.0.96-1.git.4.e6301f8.el7
Red Hat:openshift:3.6atomic-openshift-sdn-ovs0:3.6.173.0.96-1.git.4.e6301f8.el7
Red Hat:openshift:3.6atomic-openshift-service-catalog0:3.6.173.0.96-1.git.4.e6301f8.el7
Red Hat:openshift:3.6atomic-openshift-tests0:3.6.173.0.96-1.git.4.e6301f8.el7
Red Hat:openshift:3.6tuned-profiles-atomic-openshift-node0:3.6.173.0.96-1.git.4.e6301f8.el7
Red Hat:openshift:3.7atomic-openshift0:3.7.23-1.git.5.83efd71.el7
Red Hat:openshift:3.7atomic-openshift-clients0:3.7.23-1.git.5.83efd71.el7
Red Hat:openshift:3.7atomic-openshift-clients-redistributable0:3.7.23-1.git.5.83efd71.el7
Red Hat:openshift:3.7atomic-openshift-cluster-capacity0:3.7.23-1.git.5.83efd71.el7
Red Hat:openshift:3.7atomic-openshift-docker-excluder0:3.7.23-1.git.5.83efd71.el7
Red Hat:openshift:3.7atomic-openshift-dockerregistry0:3.7.23-1.git.5.83efd71.el7
Red Hat:openshift:3.7atomic-openshift-excluder0:3.7.23-1.git.5.83efd71.el7
Red Hat:openshift:3.7atomic-openshift-federation-services0:3.7.23-1.git.5.83efd71.el7
Red Hat:openshift:3.7atomic-openshift-master0:3.7.23-1.git.5.83efd71.el7
Red Hat:openshift:3.7atomic-openshift-node0:3.7.23-1.git.5.83efd71.el7
Red Hat:openshift:3.7atomic-openshift-pod0:3.7.23-1.git.5.83efd71.el7
Red Hat:openshift:3.7atomic-openshift-sdn-ovs0:3.7.23-1.git.5.83efd71.el7
Red Hat:openshift:3.7atomic-openshift-service-catalog0:3.7.23-1.git.5.83efd71.el7
Red Hat:openshift:3.7atomic-openshift-template-service-broker0:3.7.23-1.git.5.83efd71.el7
Red Hat:openshift:3.7atomic-openshift-tests0:3.7.23-1.git.5.83efd71.el7
Red Hat:openshift:3.7tuned-profiles-atomic-openshift-node0:3.7.23-1.git.5.83efd71.el7
openSUSE:Leap 15.1cri-o1.17.1-lp151.2.2
openSUSE:Leap 15.1cri-tools1.18.0-lp151.2.1
openSUSE:Leap 15.1go1.141.14-lp151.6.1
openSUSE:Leap 15.1kubernetes1.18.0-lp151.5.1