Description
Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | atomic-openshift +9 | 3.1.0.4-1.git.15.5e061c3.el7aos | RHSA-2015:2544 |
| Red Hat OpenShift 3 | openshift +5 | 3.0.2.0-0.git.38.7576bc5.el7ose | RHSA-2015:2544 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/kubernetes/kubernetes | < 1.2.0 | 1.2.0 | GHSA-mqf3-28j7-3mj6 |
Advisories 1
- RHSA-2015:2544 Red Hat Security Advisory: openshift security update Red Hat Security Advisories (RHSA) · Nov 22, 2025