In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade kubernetes | Jul 30, 2024 | Mar 13, 2018 |
| Kubernetes | — | Upgrade Kubernetes to version 1.9.4Upgrade Kubernetes to version 1.7.14Upgrade Kubernetes to version 1.8.9Upgrade Kubernetes to version 1.10.0-beta.3 | Jun 14, 2018 | Mar 13, 2018 |
| Oracle_linux | — | Upgrade kubeadmUpgrade kubeletUpgrade kubectl | Apr 11, 2018 | Mar 12, 2018 |
| Redhat Openshift | — | Upgrade atomic-openshift | Jun 18, 2018 | Mar 12, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 13, 2018 |
| Suse | — | Upgrade kubernetes-kubeadmUpgrade kubernetes-kubelet-commonUpgrade kubernetes-clientUpgrade go1.14-docUpgrade cri-toolsUpgrade kubernetes-masterUpgrade go1.14-raceUpgrade kubernetes-schedulerUpgrade kubernetes-apiserverUpgrade kubernetes-proxyUpgrade cri-oUpgrade kubernetes-controller-managerUpgrade go1.14Upgrade kubernetes-nodeUpgrade kubernetes-kubelet1.17Upgrade cri-o-kubeadm-criconfigUpgrade kubernetes-kubelet1.18 | Apr 27, 2020 | Mar 13, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub