CGA-vcfc-378w-j2p8

Published

Last updated

https://images.chainguard.dev/security/CGA-vcfc-378w-j2p8

Package

kubeflow-pipelines

Latest Update

Not affected

Aliases

CVE-2018-1002101
GHSA-wqwf-x5cj-rg56

Severity

5.9

Medium

CVSS V3

Summary

Kubernetes Arbitrary Command Injection

Description

In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection.

Specific Go Packages Affected

k8s.io/kubernetes/pkg/util/mount

References

https://nvd.nist.gov/vuln/detail/CVE-2018-1002101
https://github.com/advisories/GHSA-wqwf-x5cj-rg56
https://github.com/kubernetes/kubernetes/issues/65750
https://github.com/kubernetes/kubernetes/pull/65751
https://github.com/kubernetes/kubernetes/commit/d65039c56ce4de5f2efdc38aa1284eeb95f89169
https://security.netapp.com/advisory/ntap-20190416-0008
http://www.securityfocus.com/bid/106238

Updates

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

CGA-vcfc-378w-j2p8

Severity

Summary

Description

Specific Go Packages Affected

References

Updates

Product

Why Chainguard

Customers

Company

Resources