Skip to content
OpenAdvisories

Package · Go

github.com/kubernetes/kubernetes

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.5
    CVE-2022-3162

    Unauthorized read of Custom Resources

    Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. T…

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go
  • Medium 6.6
    CVE-2022-3294 Public exploit

    Node address isn't always verified when proxying

    Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserv…

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go
  • Medium 4.7
    CVE-2020-8563

    Secret leaks in logs for vSphere Provider kube-controller-manager

    In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.

    Kubernetes Kubernetes k8s.io/kubernetes github.com/kubernetes/kubernetes Go
  • Medium 4.7
    CVE-2020-8564

    Docker config secrets leaked when file is malformed and loglevel >= 4

    In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v…

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go
  • Medium 4.7
    CVE-2020-8566

    Ceph RBD adminSecrets exposed in logs when loglevel >= 4

    In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1…

    Kubernetes Kubernetes kubernetes k8s.io/kubernetes Debian Go
  • Medium 5.3
    CVE-2015-7528

    Information Exposure in Kubernetes

    Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name.

    github.com/kubernetes/kubernetes Go
  • Medium 6.5
    CVE-2015-5305

    Directory Traversal in Kubernetes

    Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd.

    k8s.io/kubernetes github.com/kubernetes/kubernetes Go