CVE-2017-1002100

EUVD-2017-1644
Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the Kubernetes cluster or authenticated access to the Azure portal.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 49%
Affected Products (NVD)
VendorProductVersion
kuberneteskubernetes
1.6.0
kuberneteskubernetes
1.6.0:alpha.0
kuberneteskubernetes
1.6.0:alpha.1
kuberneteskubernetes
1.6.0:alpha.2
kuberneteskubernetes
1.6.0:alpha.3
kuberneteskubernetes
1.6.0:beta.0
kuberneteskubernetes
1.6.0:beta.1
kuberneteskubernetes
1.6.0:beta.2
kuberneteskubernetes
1.6.0:beta.3
kuberneteskubernetes
1.6.0:beta.4
kuberneteskubernetes
1.6.0:rc.1
kuberneteskubernetes
1.6.1
kuberneteskubernetes
1.6.1:beta.0
kuberneteskubernetes
1.6.2
kuberneteskubernetes
1.6.2:beta.0
kuberneteskubernetes
1.6.3
kuberneteskubernetes
1.6.3:beta.0
kuberneteskubernetes
1.6.3:beta.1
kuberneteskubernetes
1.6.4
kuberneteskubernetes
1.6.4:beta.0
kuberneteskubernetes
1.6.4:beta.1
kuberneteskubernetes
1.6.5
kuberneteskubernetes
1.6.5:beta.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
kubernetes
bookworm
1.20.5+really1.20.2-1.1
fixed
bullseye
1.20.5+really1.20.2-1
fixed
sid
1.20.5+really1.20.2-1.1
fixed
trixie
1.20.5+really1.20.2-1.1
fixed
Common Weakness Enumeration
References
https://github.com/kubernetes/kubernetes/issues/47611
https://groups.google.com/d/msg/kubernetes-security-announce/n3VBg_WJZic/-ddIqKXqAAAJ
https://github.com/kubernetes/kubernetes/issues/47611
https://groups.google.com/d/msg/kubernetes-security-announce/n3VBg_WJZic/-ddIqKXqAAAJ