Skip to content
OpenAdvisories

Package · Alpine

k3s

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.9
    CVE-2023-48795 Public exploit EPSS 94%

    Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

    openssh lxd erlang openssh Debian Ubuntu Alpine PyPI Go crates.io
  • Medium 6.5
    CVE-2023-2728 Public exploit

    Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin

    Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the…

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Alpine Go
  • Medium 6.5
    CVE-2021-25735 Public exploit

    Validating Admission Webhook does not observe some previous fields

    A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at leas…

    Kubernetes Kubernetes kubernetes k8s.io/kubernetes Debian Alpine Go
  • Medium 5.2
    CVE-2020-15257 Public exploit

    containerd-shim API Exposed to Host Network Containers

    containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s AP…

    containerd containerd docker.io docker Debian Ubuntu Alpine Go
  • Medium 6.4
    CVE-2020-8559 Public exploit

    Privilege escalation from compromised node to cluster

    The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a ful…

    Kubernetes Kubernetes kubernetes k8s.io/kubernetes Debian Alpine Go
  • Medium 6.0
    CVE-2020-10749 Public exploit

    containernetworking/plugins vulnerable to MitM attacks

    A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IP…

    Red Hat containernetworking/plugins k3s github.com/containernetworking/plugins Debian Ubuntu Alpine Go