GO-2025-3522
Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API in k8s.io/kubernetes
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2024-9042
- Alias
- GHSA-vv39-3w5q-974q
Description
Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API in k8s.io/kubernetes
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · k8s.io/kubernetes | introduced 0, fixed 1.29.13, introduced 1.30.0-alpha.0, fixed 1.30.9, introduced 1.31.0-alpha.0, fixed 1.31.5, introduced 1.32.0-alpha.0, fixed 1.32.1 |
Références
- https://github.com/advisories/GHSA-vv39-3w5q-974q ADVISORY
- http://www.openwall.com/lists/oss-security/2025/01/16/1 WEB
- https://github.com/kubernetes/kubernetes/commit/45f4ccc2153bbb782253704cbe24c05e22b5d60c WEB
- https://github.com/kubernetes/kubernetes/commit/5fe148234f8ab1184f26069c4f7bef6c37efe347 WEB
- https://github.com/kubernetes/kubernetes/commit/75c83a6871dc030675288c6d63c275a43c2f0d55 WEB
- https://github.com/kubernetes/kubernetes/commit/fb0187c2bf7061258bb89891edb1237261eb7abc WEB
- https://github.com/kubernetes/kubernetes/issues/129654 WEB
- https://groups.google.com/g/kubernetes-security-announce/c/9C3vn6aCSVg WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |