Vulnerability Description
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kubernetes | Kubernetes | >= 1.3.0, <= 1.3.10 |
References
- https://access.redhat.com/errata/RHSA-2018:0475Third Party Advisory
- https://github.com/kubernetes/kubernetes/issues/60814Issue TrackingVendor Advisory
- https://access.redhat.com/errata/RHSA-2018:0475Third Party Advisory
- https://github.com/kubernetes/kubernetes/issues/60814Issue TrackingVendor Advisory
FAQ
What is CVE-2017-1002102?
CVE-2017-1002102 is a vulnerability with a CVSS score of 7.1 (HIGH). In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary ...
How severe is CVE-2017-1002102?
CVE-2017-1002102 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-1002102?
Check the references section above for vendor advisories and patch information. Affected products include: Kubernetes Kubernetes.