CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2017-1000056
https://notcve.org/view.php?id=CVE-2017-1000056
Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object. En Kubernetes versión 1.5.0 hasta 1.5.4, es vulnerable a una escalada de privilegios en el plugin admission de PodSecurityPolicy, resultando en la capacidad de hacer uso de cualquier objeto PodSecurityPolicy existente. • https://github.com/kubernetes/kubernetes/issues/43459 • CWE-862: Missing Authorization •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2015-7528 – OpenShift: pod log location must validate container if provided
https://notcve.org/view.php?id=CVE-2015-7528
Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name. Kubernetes en versiones anteriores a 1.2.0-alpha.5 permite a atacantes remotos leer logs de pod arbitrarios a través de un nombre de contenedor. It was found that OpenShift's API back end did not verify requests for pod log locations, allowing a pod on a Node to request logs for any other pod on that Node. A remote attacker could use this flaw to view sensitive information via pod logs that they would normally not have access to. • http://rhn.redhat.com/errata/RHSA-2015-2615.html https://access.redhat.com/errata/RHSA-2015:2544 https://github.com/kubernetes/kubernetes/pull/17886 https://github.com/kubernetes/kubernetes/releases/tag/v1.2.0-alpha.5 https://github.com/openshift/origin/pull/6113 https://access.redhat.com/security/cve/CVE-2015-7528 https://bugzilla.redhat.com/show_bug.cgi?id=1286745 • CWE-20: Improper Input Validation CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •