CVE-2017-1002101

Published March 13th, 2018

View on NVD ↗

CVSS v3

N/A

CVSS v2

5.5

MEDIUM

Affected

PROJECTS

Description

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem.

kubernetes/kubernetes

Production-Grade Container Scheduling and Management

GitHub

123K

bgeesaman/subpath-exploit

Writeup of CVE-2017-1002101 with sample "exploit"/escape

GitHub