Fluid Attacks Database

Description

Directory Traversal in Kubernetes Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
go	k8s.io/kubernetes	>=0 <1.1.1	1.1.1
go	github.com/kubernetes/kubernetes	>=0 <1.1.1	1.1.1

Aliases

1. CVE-2015-53052. NVD-2015-53053. OSV-2015-53054. GCVE-2015-53055. access.redhat.com6. ACCESS-CVE-2015-5305

References

1. https://github.com/kubernetes/kubernetes/pull/163812. https://github.com/kubernetes/kubernetes/commit/37f730f68c7f06e060f90714439bfb0dbb2df5e73. https://github.com/kubernetes/kubernetes/commit/68f2add9bd5d43b9da1424d87d88f83d120e17d04. https://bugzilla.redhat.com/show_bug.cgi?id=12739695. https://pkg.go.dev/vuln/GO-2022-07016. https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5305

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.