Что показывает история
История уязвимостей показывает 56 CVE с максимальным баллом CVSS 9.8 и 0 известных эксплуатируемых уязвимостей, при этом последний CVE был зарегистрирован 2023-11-14.
Как обезопасить себя
Чтобы обеспечить безопасность установленных систем, операторам следует использовать поддерживаемые версии релизов и регулярно отслеживать версии установленных компонентов.
Проверьте свою версию
kubelet --versionЗатронутые ветки версий
- 1.28 CVE: 3 Окончание поддержки
- 1.27 CVE: 6 Окончание поддержки
- 1.26 CVE: 7 Окончание поддержки
- 1.25 CVE: 9 Окончание поддержки
- 1.24 CVE: 10 Окончание поддержки
- 1.23 CVE: 10 Окончание поддержки
- 1.22 CVE: 12 Окончание поддержки
- 1.21 CVE: 14 Окончание поддержки
- 1.20 CVE: 16 Окончание поддержки
- 1.19 CVE: 18 Окончание поддержки
- 1.18 CVE: 22 Окончание поддержки
- 1.17 CVE: 25 Окончание поддержки
- 1.16 CVE: 24 Окончание поддержки
- 1.15 CVE: 28
- 1.14 CVE: 32
- 1.13 CVE: 34
- 1.12 CVE: 33
- 1.11 CVE: 33
- 1.10 CVE: 32
- 1.9 CVE: 34
- 1.8 CVE: 33
- 1.7 CVE: 31
- 1.6 CVE: 31
- 1.5 CVE: 30
- 1.4 CVE: 28
- 1.3 CVE: 28
- 1.2 CVE: 27
- 1.1 CVE: 28
- 1.0 CVE: 25
Известные уязвимости
| CVE | Название | Затронутые версии | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
| CVE-2023-5528 | Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege esca... | ≥ 1.8.0 < 1.25.16 ≥ 1.26.0 < 1.26.11 ≥ 1.27.0 < 1.27.8 | 7.2 | — | 2023-11-15 | |
| CVE-2023-3955 | Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation | < 1.24.17 ≥ 1.25.0 < 1.25.13 ≥ 1.26.0 < 1.26.8 | 8.8 | — | 2023-11-01 | |
| CVE-2023-3676 | Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation | < 1.24.17 ≥ 1.25.0 < 1.25.13 ≥ 1.26.0 < 1.26.8 | 8.8 | — | 2023-11-01 | |
| CVE-2021-25736 | Windows kube-proxy LoadBalancer contention | ≥ 1.18.0 < 1.18.18 ≥ 1.19.0 < 1.19.10 ≥ 1.20.0 < 1.20.6 | 5.8 | — | 2023-10-30 | |
| CVE-2023-2728 | Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin | ≤ 1.24.14 ≥ 1.25.0 ≤ 1.25.10 ≥ 1.26.0 ≤ 1.26.5 | 6.5 | — | 2023-07-04 | |
| CVE-2023-2727 | Bypassing policies imposed by the ImagePolicyWebhook admission plugin | ≤ 1.24.14 ≥ 1.25.0 ≤ 1.25.10 ≥ 1.26.0 ≤ 1.26.5 | 6.5 | — | 2023-07-04 | |
| CVE-2023-2431 | Bypass of seccomp profile enforcement | < 1.24.14 ≥ 1.25.0 < 1.25.10 ≥ 1.26.0 < 1.26.5 | 3.4 | — | 2023-06-16 | |
| CVE-2021-25749 | runAsNonRoot logic bypass for Windows containers | ≥ 1.20.0 ≤ 1.21.0 ≥ 1.22.0 < 1.22.14 ≥ 1.23.0 < 1.23.11 | 7.8 | — | 2023-05-24 | |
| CVE-2022-3162 | Unauthorized read of Custom Resources | ≤ 1.22.15 ≥ 1.23.0 ≤ 1.23.13 ≥ 1.24.0 ≤ 1.24.7 | 6.5 | — | 2023-03-01 | |
| CVE-2022-3294 | Node address isn't always verified when proxying | < 1.22.16 ≥ 1.23.0 < 1.23.14 ≥ 1.24.0 < 1.24.8 | 6.6 | — | 2023-03-01 | |
| CVE-2020-8562 | Bypass of Kubernetes API Server proxy TOCTOU | ≤ 1.18.18 ≥ 1.19.0 ≤ 1.19.10 ≥ 1.20.0 ≤ 1.20.6 | 2.2 | — | 2022-02-01 | |
| CVE-2021-25743 | ANSI escape characters in kubectl output are not being filtered | ≤ 1.25.0 = 1.26.0 | 3.0 | — | 2022-01-07 | |
| CVE-2021-25741 | Symlink Exchange Can Allow Host Filesystem Access | ≤ 1.19.14 ≥ 1.20.0 ≤ 1.20.10 ≥ 1.21.0 ≤ 1.21.4 | 8.8 | — | 2021-09-21 | |
| CVE-2021-25740 | Holes in EndpointSlice Validation Enable Host Network Hijack | * | 3.1 | — | 2021-09-21 | |
| CVE-2020-8561 | Webhook redirect in kube-apiserver | = 1.20.11 = 1.21.5 = 1.22.2 | 4.1 | — | 2021-09-21 | |
| CVE-2021-25737 | Holes in EndpointSlice Validation Enable Host Network Hijack | ≥ 1.16.0 < 1.18.19 ≥ 1.19.0 < 1.19.10 ≥ 1.20.0 < 1.20.7 | 2.7 | — | 2021-09-06 | |
| CVE-2021-25735 | Validating Admission Webhook does not observe some previous fields | < 1.18.18 ≥ 1.19.0 < 1.19.10 ≥ 1.20.0 < 1.20.6 | 6.5 | — | 2021-09-06 | |
| CVE-2020-8554 | Kubernetes man in the middle using LoadBalancer or ExternalIPs | * | 6.3 | — | 2021-01-22 | |
| CVE-2020-8563 | Secret leaks in logs for vSphere Provider kube-controller-manager | < 1.19.3 | 4.7 | — | 2020-12-08 | |
| CVE-2020-8564 | Docker config secrets leaked when file is malformed and loglevel >= 4 | ≥ 1.17.0 < 1.17.13 ≥ 1.18.0 < 1.18.10 ≥ 1.19.0 < 1.19.3 | 4.7 | — | 2020-12-08 | |
| CVE-2020-8565 | Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9 | ≥ 1.17.0 ≤ 1.17.13 ≥ 1.18.0 ≤ 1.18.10 ≥ 1.19.0 ≤ 1.19.3 | 4.7 | — | 2020-12-08 | |
| CVE-2020-8566 | Ceph RBD adminSecrets exposed in logs when loglevel >= 4 | ≥ 1.17.0 < 1.17.13 ≥ 1.18.0 < 1.18.10 ≥ 1.19.0 < 1.19.3 | 4.7 | — | 2020-12-08 | |
| CVE-2020-8558 | Kubernetes node setting allows for neighboring hosts to bypass localhost boundary | ≥ 1.1.0 ≤ 1.16.10 ≥ 1.17.0 ≤ 1.17.6 ≥ 1.18.0 ≤ 1.18.3 | 5.4 | — | 2020-07-28 | |
| CVE-2020-8557 | Kubernetes node disk Denial of Service by writing to container /etc/hosts | < 1.16.13 ≥ 1.17.0 < 1.17.9 ≥ 1.18.0 < 1.18.6 | 5.5 | — | 2020-07-24 | |
| CVE-2019-11252 | Credential leakage when failing to mount | ≥ 1.0.0 ≤ 1.17.0 | 5.9 | — | 2020-07-23 | |
| CVE-2020-8559 | Privilege escalation from compromised node to cluster | ≥ 1.6.0 ≤ 1.15.0 ≥ 1.16.0 < 1.16.13 ≥ 1.17.0 < 1.17.9 | 6.4 | — | 2020-07-22 | |
| CVE-2020-8555 | Kubernetes kube-controller-manager SSRF | < 1.15.11 ≥ 1.16.0 < 1.16.9 ≥ 1.17.0 < 1.17.5 | 6.3 | — | 2020-06-05 | |
| CVE-2019-11254 | Kubernetes API Server denial of service vulnerability from malicious YAML payloads | < 1.15.10 ≥ 1.16.0 < 1.16.7 ≥ 1.17.0 < 1.17.3 | 6.5 | — | 2020-04-02 | |
| CVE-2020-8552 | Kubernetes API server denial of service | ≤ 1.15.9 ≥ 1.16.0 ≤ 1.16.6 ≥ 1.17.0 ≤ 1.17.2 | 5.3 | — | 2020-03-27 | |
| CVE-2020-8551 | Kubernetes kubelet denial of service | ≥ 1.15.0 ≤ 1.15.9 ≥ 1.16.0 ≤ 1.16.6 ≥ 1.17.0 ≤ 1.17.2 | 4.3 | — | 2020-03-27 | |
| CVE-2019-11251 | kubectl cp allows symlink directory traversal | ≥ 1.13.0 < 1.13.11 ≥ 1.14.0 < 1.14.7 ≥ 1.15.0 < 1.15.4 | 4.8 | — | 2020-02-04 | |
| CVE-2018-1002102 | Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints | ≥ 1.10.0 ≤ 1.13.13 = 1.14.0 | 2.6 | — | 2019-12-06 | |
| CVE-2019-11253 | Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack | ≥ 1.1.0 ≤ 1.12.10 ≥ 1.13.0 < 1.13.12 ≥ 1.14.0 < 1.14.8 | 7.5 | — | 2019-10-18 | |
| CVE-2019-11250 | Kubernetes client-go logs authorization headers at debug verbosity levels | < 1.15.3 = 1.15.3 = 1.15.4 | 4.7 | — | 2019-08-29 | |
| CVE-2019-11249 | kubectl cp allows symlink directory traversal | ≥ 1.0.0 ≤ 1.12.10 ≥ 1.13.0 < 1.13.9 ≥ 1.14.0 < 1.14.5 | 4.8 | — | 2019-08-29 | |
| CVE-2019-11248 | Kubernetes kubelet exposes /debug/pprof info on healthz port | < 1.12.10 = 1.13.0 = 1.13.1 | 6.5 | — | 2019-08-29 | |
| CVE-2019-11247 | Kubernetes kube-apiserver allows access to custom resources via wrong scope | ≥ 1.7.0 ≤ 1.12.10 ≥ 1.13.0 < 1.13.9 ≥ 1.14.0 < 1.14.5 | 5.0 | — | 2019-08-29 | |
| CVE-2019-11246 | kubectl cp allows symlink directory traversal | ≥ 1.0.0 ≤ 1.12.10 ≥ 1.13.0 < 1.13.9 ≥ 1.14.0 < 1.14.5 | 6.4 | — | 2019-08-29 | |
| CVE-2019-11245 | kubelet-started container uid changes to root after first restart or if image is already pulled to the node | = 1.13.6 = 1.14.2 | 4.9 | — | 2019-08-29 | |
| CVE-2019-11243 | In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provi... | ≥ 1.12.0 ≤ 1.12.4 = 1.13.0 | 3.1 | — | 2019-04-22 | |
| CVE-2019-11244 | kubectl creates world-writeable cached schema files | ≥ 1.8.0 ≤ 1.14.1 | 3.3 | — | 2019-04-22 | |
| CVE-2019-9946 | Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall mis... | < 1.11.9 ≥ 1.12.0 < 1.12.7 ≥ 1.13.0 < 1.13.5 | 7.5 | — | 2019-04-03 | |
| CVE-2019-1002100 | In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch req... | < 1.11.8 ≥ 1.12.0 < 1.12.6 ≥ 1.13.0 < 1.13.4 | 6.5 | — | 2019-04-01 | |
| CVE-2019-1002101 | kubectl cp path traversal | ≥ 1.11.0 < 1.11.9 ≥ 1.12.0 < 1.12.7 ≥ 1.13.0 < 1.13.5 | 6.4 | — | 2019-04-01 | |
| CVE-2018-1002101 | In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while... | ≥ 1.9.0 ≤ 1.9.9 ≥ 1.10.0 ≤ 1.10.5 ≥ 1.11.0 ≤ 1.11.1 | 5.9 | — | 2018-12-06 | |
| CVE-2018-1002105 | In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to p... | ≥ 1.0.0 ≤ 1.9.11 ≥ 1.10.0 ≤ 1.10.10 ≥ 1.11.0 ≤ 1.11.4 | 9.8 | — | 2018-12-06 | |
| CVE-2016-7075 | It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client interme... | * | 7.5 | — | 2018-09-10 | |
| CVE-2018-1002100 | In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecure... | ≥ 1.5.0 ≤ 1.5.9 ≥ 1.6.0 ≤ 1.6.14 ≥ 1.7.0 ≤ 1.7.17 | 4.2 | — | 2018-06-02 | |
| CVE-2017-1002101 | In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers usi... | ≥ 1.3.0 ≤ 1.3.10 ≥ 1.4.0 ≤ 1.4.12 ≥ 1.5.0 ≤ 1.5.8 | 8.8 | — | 2018-03-14 | |
| CVE-2017-1002102 | In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers usi... | ≥ 1.3.0 ≤ 1.3.10 ≥ 1.4.0 ≤ 1.4.12 ≥ 1.5.0 ≤ 1.5.8 | 7.1 | — | 2018-03-14 | |
| CVE-2017-1002100 | Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in vers... | = 1.6.0 = 1.6.1 = 1.6.2 | 6.5 | — | 2017-09-14 | |
| CVE-2015-7561 | Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should the... | * | 3.1 | — | 2017-08-08 | |
| CVE-2017-1000056 | Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plug... | = 1.5.0 = 1.5.1 = 1.5.2 | 9.8 | — | 2017-07-14 | |
| CVE-2015-7528 | Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name. | ≤ 1.2.0 | 5.3 | — | 2016-04-12 | |
| CVE-2016-1905 | The API server in Kubernetes does not properly check admission control, which allows remote authenticated user... | * | 7.7 | — | 2016-02-04 | |
| CVE-2016-1906 | Openshift allows remote attackers to gain privileges by updating a build configuration that was created with a... | * | 9.8 | — | 2016-02-04 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).