CVE-2017-1002101

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem.

Metrics

CVSS 3.0 9.6/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-59

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10021025.6In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projec CVE-2017-10021506.1python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection CVE-2017-10021517.5Pagure 3.3.0 and earlier is vulnerable to loss of confidentially due to improper authorization CVE-2017-10021526.1Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles.CVE-2017-10021537.5Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.CVE-2017-10021579.8modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution.CVE-2017-100224.3Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Operations). Support CVE-2017-10022016.1In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escape CVE-2017-100236.5Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Operations). Support CVE-2017-100248.2Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: Layout Tools). The supported version that is affected CVE-2017-100258.2Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). The supported version that is CVE-2017-100268.2Vulnerability in the Oracle SOA Suite component of Oracle Fusion Middleware (subcomponent: Fabric Layer). The supported version that is affe