CVE-2017-1000056

Description

Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object.

CVSS Metrics

• v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• v3.0•CRITICAL•Score: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 0.26%• Percentile: 49%

Techniques & Countermeasures

• CWE-862•Missing Authorization

  The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Affected Systems

• k8s.io•kubernetes

  ≥ 1.5.0, < 1.5.5

• kubernetes•kubernetes

  1.5.0 | 1.5.1 | 1.5.2 | 1.5.3 | 1.5.4

References (5)

• https://github.com/kubernetes/kubernetes/issues/43459
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000056
• https://github.com/kubernetes/kubernetes/commit/7fef0a4f6a44ea36f166c39fdade5324eff2dd5e
• https://github.com/kubernetes/kubernetes
• https://github.com/advisories/GHSA-2jx2-76rc-2v7v