Fluid Attacks Database

Description

Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API A security vulnerability has been discovered in Kubernetes windows nodes that could allow a user with the ability to query a node's '/logs' endpoint to execute arbitrary commands on the host. This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
go	k8s.io/kubernetes	>=0 <1.29.13 \|\| >=1.30.0-alpha.0 <1.30.9 \|\| >=1.31.0-alpha.0 <1.31.5 \|\| >=1.32.0-alpha.0 <1.32.1	1.29.13, 1.30.9, 1.31.5, 1.32.1

Aliases

1. CVE-2024-90422. NVD-2024-90423. OSV-2024-90424. GCVE-2024-9042

References

1. https://github.com/kubernetes/kubernetes/issues/1296542. https://github.com/kubernetes/kubernetes/commit/45f4ccc2153bbb782253704cbe24c05e22b5d60c3. https://github.com/kubernetes/kubernetes/commit/5fe148234f8ab1184f26069c4f7bef6c37efe3474. https://github.com/kubernetes/kubernetes/commit/75c83a6871dc030675288c6d63c275a43c2f0d555. https://github.com/kubernetes/kubernetes/commit/fb0187c2bf7061258bb89891edb1237261eb7abc6. https://groups.google.com/g/kubernetes-security-announce/c/9C3vn6aCSVg7. http://www.openwall.com/lists/oss-security/2025/01/16/1

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.