CVE-2024-5321
Fixed in a distro release EPSS <1%CVSS 6.1
A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs.
Products: Kubernetes
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | k8s.io/kubernetes | 1.27.16 |
| Go | k8s.io/kubernetes | 1.28.12 |
| Go | k8s.io/kubernetes | 1.29.7 |
| Go | k8s.io/kubernetes | 1.30.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | argo-cd-2.11 | no fix |
| Chainguard | argo-cd-2.12 | 2.12.3-r1 |
| Chainguard | argo-cd-2.12-compat | 2.12.3-r1 |
| Chainguard | argo-cd-2.12-repo-server | 2.12.3-r1 |
| Chainguard | argo-cd-fips-2.12 | 2.12.3-r2 |
| Chainguard | argo-cd-fips-2.12-compat | 2.12.3-r2 |
| Chainguard | argo-cd-fips-2.12-repo-server | 2.12.3-r2 |
| Chainguard | argocd-image-updater | 0.17.0-r1 |
| Chainguard | argocd-image-updater-fips | 0.17.0-r2 |
| Chainguard | aws-ebs-csi-driver | 1.32.0-r3 |
| Chainguard | aws-ebs-csi-driver-fips | 1.32.0-r3 |
| Chainguard | aws-efs-csi-driver | 2.1.1-r0 |
| Chainguard | aws-efs-csi-driver-fips | 2.1.14-r1 |
| Chainguard | calico-3.27 | 3.27.5-r33 |
| Chainguard | calico-apiserver-3.27 | 3.27.5-r33 |
| Chainguard | calico-apiserver-compat-3.27 | 3.27.5-r33 |
| Chainguard | calico-apiserver-compat-fips-3.27 | 3.27.5-r35 |
| Chainguard | calico-apiserver-fips-3.27 | 3.27.5-r35 |
| Chainguard | calico-apiserver-fips-3.28 | 3.28.3-r33 |
| Chainguard | calico-app-policy-3.27 | 3.27.5-r33 |
| Chainguard | calico-app-policy-fips-3.27 | 3.27.5-r35 |
| Chainguard | calico-app-policy-fips-3.28 | 3.28.3-r33 |
| Chainguard | calico-cni-3.27 | 3.27.5-r33 |
| Chainguard | calico-cni-compat-3.27 | 3.27.5-r33 |
| Chainguard | calico-cni-compat-fips-3.27 | 3.27.5-r35 |
| Chainguard | calico-cni-compat-fips-3.28 | 3.28.3-r33 |
| Chainguard | calico-cni-fips-3.27 | 3.27.5-r35 |
| Chainguard | calico-cni-fips-3.28 | 3.28.3-r33 |
| Chainguard | calico-felix-3.27 | 3.27.5-r33 |
| Chainguard | calico-felix-fips-3.27 | 3.27.5-r35 |
| Chainguard | calico-felix-fips-3.28 | 3.28.3-r33 |
| Chainguard | calico-fips-3.27 | 3.27.5-r35 |
| Chainguard | calico-fips-3.28 | 3.28.3-r33 |
| Chainguard | calico-key-cert-provisioner-fips-3.28 | 3.28.3-r33 |
| Chainguard | calico-kube-controllers-3.27 | 3.27.5-r33 |
| Chainguard | calico-kube-controllers-fips-3.27 | 3.27.5-r35 |
| Chainguard | calico-kube-controllers-fips-3.28 | 3.28.3-r33 |
| Chainguard | calico-node-3.27 | 3.27.5-r33 |
| Chainguard | calico-node-fips-3.27 | 3.27.5-r35 |
| Chainguard | calico-node-fips-3.28 | 3.28.3-r33 |
| Chainguard | calico-pod2daemon-3.27 | 3.27.5-r33 |
| Chainguard | calico-pod2daemon-fips-3.27 | 3.27.5-r35 |
| Chainguard | calico-pod2daemon-fips-3.28 | 3.28.3-r33 |
| Chainguard | calico-pod2daemon-flexvol-compat-3.27 | 3.27.5-r33 |
| Chainguard | calico-pod2daemon-flexvol-compat-fips-3.27 | 3.27.5-r35 |
| Chainguard | calico-typha-client-3.27 | 3.27.5-r33 |
| Chainguard | calico-typha-client-fips-3.27 | 3.27.5-r35 |
| Chainguard | calico-typha-client-fips-3.28 | 3.28.3-r33 |
| Chainguard | calico-typhad-3.27 | 3.27.5-r33 |
| Chainguard | calico-typhad-fips-3.27 | 3.27.5-r35 |
| Chainguard | calico-typhad-fips-3.28 | 3.28.3-r33 |
| Chainguard | calicoctl-3.27 | 3.27.5-r33 |
| Chainguard | calicoctl-fips-3.27 | 3.27.5-r35 |
| Chainguard | calicoctl-fips-3.28 | 3.28.3-r33 |
| Chainguard | cluster-autoscaler-1.28 | 1.28.5-r3 |
| Chainguard | cluster-autoscaler-1.28-compat | 1.28.5-r3 |
| Chainguard | cluster-autoscaler-1.29 | 1.29.4-r0 |
| Chainguard | cluster-autoscaler-1.29-compat | 1.29.4-r0 |
| Chainguard | cluster-autoscaler-1.30 | 1.30.2-r1 |
| Chainguard | cluster-autoscaler-1.30-compat | 1.30.2-r1 |
| Chainguard | cluster-autoscaler-fips-1.28 | 1.28.6-r1 |
| Chainguard | cluster-autoscaler-fips-1.28-compat | 1.28.6-r1 |
| Chainguard | cluster-autoscaler-fips-1.29 | 1.29.5-r8 |
| Chainguard | cluster-autoscaler-fips-1.29-compat | 1.29.5-r8 |
| Chainguard | cluster-autoscaler-fips-1.30 | 1.30.2-r1 |
| Chainguard | cluster-autoscaler-fips-1.30-compat | 1.30.2-r1 |
| Chainguard | cri-tools | 1.30.1-r1 |
| Chainguard | crictl | 1.30.1-r1 |
| Chainguard | critest | 1.30.1-r1 |
| Chainguard | gpu-feature-discovery | 0.8.2-r4 |
| Chainguard | gpu-feature-discovery | 0.8.2-r3 |
| Chainguard | ip-masq-agent | 2.9.3-r14 |
| Chainguard | kube-apiserver-fips-1.28 | 1.28.15-r9 |
| Chainguard | kube-apiserver-fips-1.28-default | 1.28.15-r9 |
| Chainguard | kube-apiserver-fips-1.29 | 0 |
| Chainguard | kube-apiserver-fips-1.29-default | 0 |
| Chainguard | kube-apiserver-fips-1.30 | 0 |
| Chainguard | kube-apiserver-fips-1.30-default | 0 |
| Chainguard | kube-apiserver-fips-1.30-default-compat | 0 |
| Chainguard | kube-controller-manager-fips-1.28 | 1.28.15-r9 |
| Chainguard | kube-controller-manager-fips-1.28-default | 1.28.15-r9 |
| Chainguard | kube-controller-manager-fips-1.29 | 0 |
| Chainguard | kube-controller-manager-fips-1.29-default | 0 |
| Chainguard | kube-controller-manager-fips-1.30 | 0 |
| Chainguard | kube-controller-manager-fips-1.30-default | 0 |
| Chainguard | kube-controller-manager-fips-1.30-default-compat | 0 |
| Chainguard | kube-proxy-fips-1.28 | 1.28.15-r9 |
| Chainguard | kube-proxy-fips-1.28-default | 1.28.15-r9 |
| Chainguard | kube-proxy-fips-1.29 | 0 |
| Chainguard | kube-proxy-fips-1.29-default | 0 |
| Chainguard | kube-proxy-fips-1.30 | 0 |
| Chainguard | kube-proxy-fips-1.30-default | 0 |
| Chainguard | kube-proxy-fips-1.30-default-compat | 0 |
| Chainguard | kube-scheduler-fips-1.28 | 1.28.15-r9 |
| Chainguard | kube-scheduler-fips-1.28-default | 1.28.15-r9 |
| Chainguard | kube-scheduler-fips-1.29 | 0 |
| Chainguard | kube-scheduler-fips-1.29-default | 0 |
| Chainguard | kube-scheduler-fips-1.30 | 0 |
| Chainguard | kube-scheduler-fips-1.30-default | 0 |
| Chainguard | kube-scheduler-fips-1.30-default-compat | 0 |
| Chainguard | kubeadm-fips-1.28 | 1.28.15-r9 |
| Chainguard | kubeadm-fips-1.28-default | 1.28.15-r9 |
| Chainguard | kubeadm-fips-1.29 | 0 |
| Chainguard | kubeadm-fips-1.29-default | 0 |
| Chainguard | kubeadm-fips-1.30 | 0 |
| Chainguard | kubeadm-fips-1.30-default | 0 |
| Chainguard | kubeadm-fips-1.30-default-compat | 0 |
| Chainguard | kubectl-bash-completion-fips-1.28 | 1.28.15-r9 |
| Chainguard | kubectl-bash-completion-fips-1.29 | 0 |
| Chainguard | kubectl-bash-completion-fips-1.30 | 0 |
| Chainguard | kubectl-fips-1.28 | 1.28.15-r9 |
| Chainguard | kubectl-fips-1.28-default | 1.28.15-r9 |
| Chainguard | kubectl-fips-1.29 | 0 |
| Chainguard | kubectl-fips-1.29-default | 0 |
| Chainguard | kubectl-fips-1.30 | 0 |
| Chainguard | kubectl-fips-1.30-default | 0 |
| Chainguard | kubectl-fips-1.30-default-compat | 0 |
| Chainguard | kubeflow-pipelines | 2.2.0-r8 |
| Chainguard | kubeflow-pipelines-apiserver | 2.2.0-r8 |
| Chainguard | kubeflow-pipelines-cache-deployer | 2.2.0-r8 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 2.2.0-r8 |
| Chainguard | kubeflow-pipelines-cache_server | 2.2.0-r8 |
| Chainguard | kubeflow-pipelines-frontend | 2.2.0-r8 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 2.2.0-r8 |
| Chainguard | kubeflow-pipelines-metadata-writer | 2.2.0-r8 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 2.2.0-r8 |
| Chainguard | kubeflow-pipelines-persistence_agent | 2.2.0-r8 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 2.2.0-r8 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 2.2.0-r8 |
| Chainguard | kubelet-fips-1.28 | 1.28.15-r9 |
| Chainguard | kubelet-fips-1.28-default | 1.28.15-r9 |
| Chainguard | kubelet-fips-1.29 | 0 |
| Chainguard | kubelet-fips-1.29-default | 0 |
| Chainguard | kubelet-fips-1.30 | 0 |
| Chainguard | kubelet-fips-1.30-default | 0 |
| Chainguard | kubelet-fips-1.30-default-compat | 0 |
| Chainguard | kubernetes-1.27 | 0 |
| Chainguard | kubernetes-csi-driver-hostpath | 1.14.0-r3 |
| Chainguard | kubernetes-dns-node-cache | 1.23.1-r3 |
| Chainguard | kubernetes-dns-node-cache-fips | 1.23.1-r2 |
| Chainguard | kubernetes-fips-1.28 | 1.28.15-r9 |
| Chainguard | kubernetes-fips-1.28-default | 1.28.15-r9 |
| Chainguard | kubernetes-fips-1.29 | 0 |
| Chainguard | kubernetes-fips-1.29-default | 0 |
| Chainguard | kubernetes-fips-1.30 | 0 |
| Chainguard | kubernetes-fips-1.30-default | 0 |
| Chainguard | local-static-provisioner | 2.7.0-r5 |
| Chainguard | local-static-provisioner-compat | 2.7.0-r5 |
| Chainguard | local-volume-node-cleanup | 2.7.0-r5 |
| Chainguard | local-volume-node-cleanup-compat | 2.7.0-r5 |
| Chainguard | node-feature-discovery-0.15 | 0.15.6-r1 |
| Chainguard | node-feature-discovery-0.16 | 0.16.3-r1 |
| Chainguard | nodetaint | 0.0.4-r21 |
| Chainguard | rancher-webhook-0.4 | 0.4.18-r2 |
| Chainguard | rancher-webhook-0.5 | 0.5.12-r17 |
| Chainguard | rancher-webhook-fips-0.4 | 0.4.18-r4 |
| Chainguard | rancher-webhook-fips-0.5 | 0.5.11-r0 |
| Chainguard | spark-operator | 1.4.3-r1 |
| Chainguard | spark-operator-oci-entrypoint | 1.4.3-r1 |
| Chainguard | sparkctl | 1.4.3-r1 |
| Ubuntu 22.04 LTS | kubernetes | no fix |
| Ubuntu 24.04 LTS | kubernetes | no fix |
| Ubuntu Pro 20.04 LTS | kubernetes | no fix |
| Wolfi | argo-cd-2.12 | 2.12.3-r1 |
| Wolfi | argo-cd-2.12-compat | 2.12.3-r1 |
| Wolfi | argo-cd-2.12-repo-server | 2.12.3-r1 |
| Wolfi | argocd-image-updater | 0.17.0-r1 |
| Wolfi | aws-ebs-csi-driver | 1.32.0-r3 |
| Wolfi | aws-efs-csi-driver | 2.1.1-r0 |
| Wolfi | cluster-autoscaler-1.30 | 1.30.2-r1 |
| Wolfi | cluster-autoscaler-1.30-compat | 1.30.2-r1 |
| Wolfi | cri-tools | 1.30.1-r1 |
| Wolfi | crictl | 1.30.1-r1 |
| Wolfi | critest | 1.30.1-r1 |
| Wolfi | gpu-feature-discovery | 0.8.2-r4 |
| Wolfi | gpu-feature-discovery | 0.8.2-r3 |
| Wolfi | ip-masq-agent | 2.9.3-r14 |
| Wolfi | kubeflow-pipelines | 2.2.0-r8 |
| Wolfi | kubeflow-pipelines-apiserver | 2.2.0-r8 |
| Wolfi | kubeflow-pipelines-cache-deployer | 2.2.0-r8 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 2.2.0-r8 |
| Wolfi | kubeflow-pipelines-cache_server | 2.2.0-r8 |
| Wolfi | kubeflow-pipelines-frontend | 2.2.0-r8 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 2.2.0-r8 |
| Wolfi | kubeflow-pipelines-metadata-writer | 2.2.0-r8 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 2.2.0-r8 |
| Wolfi | kubeflow-pipelines-persistence_agent | 2.2.0-r8 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 2.2.0-r8 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 2.2.0-r8 |
| Wolfi | kubernetes-csi-driver-hostpath | 1.14.0-r3 |
| Wolfi | kubernetes-dns-node-cache | 1.23.1-r3 |
| Wolfi | local-static-provisioner | 2.7.0-r5 |
| Wolfi | local-static-provisioner-compat | 2.7.0-r5 |
| Wolfi | local-volume-node-cleanup | 2.7.0-r5 |
| Wolfi | local-volume-node-cleanup-compat | 2.7.0-r5 |
| Wolfi | node-feature-discovery-0.16 | 0.16.3-r1 |
| Wolfi | nodetaint | 0.0.4-r21 |
| Wolfi | spark-operator | 1.4.3-r1 |
| Wolfi | spark-operator-oci-entrypoint | 1.4.3-r1 |
| Wolfi | sparkctl | 1.4.3-r1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 |