Kubernetes vulnerable to path traversal
Moderate severity
GitHub Reviewed
Published
Mar 1, 2023
to the GitHub Advisory Database
•
Updated May 11, 2023
Package
Affected versions
>= 1.25.0, < 1.25.3
>= 1.24.0, < 1.24.8
>= 1.23.0, < 1.23.14
>= 1.22.0, < 1.22.16
Patched versions
1.25.4
1.24.8
1.23.14
1.22.16
Description
Published by the National Vulnerability Database
Mar 1, 2023
Published to the GitHub Advisory Database
Mar 1, 2023
Reviewed
Mar 10, 2023
Last updated
May 11, 2023
Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.
References