CVE-2024-10220

Description

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

Reserved 2024-10-21 | Published 2024-11-22 | Updated 2024-11-25 | Assigner kubernetes

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Default status
unaffected

Any version
affected

1.29.0
affected

1.30.0
affected

1.31.0
unaffected

1.30.3
unaffected

1.29.7
unaffected

1.28.12
unaffected

Credits

Imre Rad finder

Imre Rad remediation developer

References

github.com/kubernetes/kubernetes/issues/128885 issue-tracking

groups.google.com/...ernetes-security-announce/c/ptNgV5Necko mailing-list

cve.org (CVE-2024-10220)

nvd.nist.gov (CVE-2024-10220)

Download JSON