CVE-2018-1002101

In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection.

Published: Dec 5, 2018
Updated: May 9, 2024
CVE: CVE-2018-1002101
GHSA: GHSA-wqwf-x5cj-rg56
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-78

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
kubernetes / kubernetes	1.11.0	1.11.1.x
kubernetes / kubernetes	1.10.0	1.10.5.x
kubernetes / kubernetes	1.9.0	1.9.9.x
k8s.io/kubernetes/pkg/util/mount	1.9.0	1.9.10
k8s.io/kubernetes/pkg/util/mount	1.10.0	1.10.6
k8s.io/kubernetes/pkg/util/mount	1.11.0	1.11.2

http://www.securityfocus.com/bid/106238
https://github.com/kubernetes/kubernetes/commit/d65039c56ce4de5f2efdc38aa1284eeb95f89169
https://github.com/kubernetes/kubernetes/issues/65750
https://github.com/kubernetes/kubernetes/pull/65751
https://security.netapp.com/advisory/ntap-20190416-0008/

Vulnerability Database

289,697

CVE-2018-1002101