Package
eks-distro-kube-apiserver-fips-1.37
Component
k8s.io/kubernetes
Latest update
3.1
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
CVE-2024-7598 (GHSA-r56h-j38w-hrqq) is a network-policy bypass during namespace termination affecting k8s.io/kubernetes/cmd/kube-apiserver in the range >= 1.3.0, <= 1.32.3. It was fixed upstream by KEP-5080 "Ordered Namespace Deletion" (kubernetes/enhancements#5095), whose OrderedNamespaceDeletion feature gate landed in Kubernetes 1.33 and went stable in 1.34. This artifact vendors k8s.io/kubernetes v1.37.0-rc.0, which is outside the vulnerable range, so it is not affected. The Go vulnerability database record GO-2025-3547 declares only introduced: 1.3.0 with no fixed version, so scanners flag every later release. This matches the false-positive determinations already recorded for this vulnerability on the eks-distro 1.30-1.36 streams.
Status