-
Notifications
You must be signed in to change notification settings - Fork 43.2k
CVE-2024-9042: Command Injection affecting Windows nodes via nodes/*/logs/query API #129654
Copy link
Copy link
Closed
Closed
Copy link
Labels
area/kubeletarea/securitycommittee/security-responseDenotes an issue or PR intended to be handled by the product security committee.Denotes an issue or PR intended to be handled by the product security committee.kind/bugCategorizes issue or PR as related to a bug.Categorizes issue or PR as related to a bug.needs-triageIndicates an issue or PR lacks a `triage/foo` label and requires one.Indicates an issue or PR lacks a `triage/foo` label and requires one.official-cve-feedIssues or PRs related to CVEs officially announced by Security Response Committee (SRC)Issues or PRs related to CVEs officially announced by Security Response Committee (SRC)sig/nodeCategorizes an issue or PR as relevant to SIG Node.Categorizes an issue or PR as relevant to SIG Node.
Description
Metadata
Metadata
Assignees
Labels
area/kubeletarea/securitycommittee/security-responseDenotes an issue or PR intended to be handled by the product security committee.Denotes an issue or PR intended to be handled by the product security committee.kind/bugCategorizes issue or PR as related to a bug.Categorizes issue or PR as related to a bug.needs-triageIndicates an issue or PR lacks a `triage/foo` label and requires one.Indicates an issue or PR lacks a `triage/foo` label and requires one.official-cve-feedIssues or PRs related to CVEs officially announced by Security Response Committee (SRC)Issues or PRs related to CVEs officially announced by Security Response Committee (SRC)sig/nodeCategorizes an issue or PR as relevant to SIG Node.Categorizes an issue or PR as relevant to SIG Node.
Type
Fields
Give feedbackNo fields configured for issues without a type.
Projects
StatusShow more project fields
Done
Hello Kubernetes Community,
A security vulnerability has been discovered in Kubernetes windows nodes that could allow a user with the ability to query a node's '/logs' endpoint to execute arbitrary commands on the host.
This issue has been rated Medium with a CVSS v3.1 score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) and assigned CVE-2024-9042.
Am I vulnerable?
This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.
Affected Components
Kubelet
Affected Versions
v1.32.0
v1.31.0 to v1.31.4
v1.30.0 to v1.30.8
<=v1.29.12
How do I mitigate this vulnerability?
To mitigate this vulnerability, you need to upgrade the Kubelet on your Windows worker nodes to one of the fixed versions listed below.
Fixed Versions
v1.32.1
v1.31.5
v1.30.9
v1.29.13
Detection
To detect whether this vulnerability has been exploited, you can examine your cluster's audit logs to search for node 'logs' queries with suspicious inputs.
If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io
Acknowledgements
This vulnerability was reported by Peled, Tomer and mitigated by Aravindh Puthiyaprambil.