Description
Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | openshift +5 | 3.0.2.0-0.git.20.656dc3e.el7ose | RHSA-2015:1945 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/kubernetes/kubernetes | < 1.1.1 | 1.1.1 | GHSA-jp32-vmm6-3vf5 |
| Go | k8s.io/kubernetes | < 1.1.1 | 1.1.1 | GHSA-jp32-vmm6-3vf5 |
Advisories 1
- RHSA-2015:1945 Red Hat Security Advisory: kubernetes security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1273969
- RHSA-2015:1945 vendor-advisory