CVE-2021-25741

HIGH8.1EPSS 33.0%

Files or Directories Accessible to External Parties in kubernetes

發布日:2021/11/1修改日:2026/2/4

也稱為:GHSA-f5f7-6478-qm6pCGA-w3f5-75v2-fp9fGO-2022-0910

描述

A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

受影響套件(3)

Debian/kubernetesfrom 0, < 1.20.5+really1.20.2-1
Go/k8s.io/kubernetesfrom 0, < 1.19.15
Go/k8s.io/kubernetesfrom 0, < 1.19.15, >= 1.20.0, < 1.20.11, >= 1.21.0, < 1.21.5, >= 1.22.0, < 1.22.2

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

參考連結(7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-25741
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2021-25741
PATCHhttps://github.com/kubernetes/kubernetes
WEBhttps://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-f5f7-6478-qm6p
WEBhttps://github.com/kubernetes/kubernetes/issues/104980
WEBhttps://groups.google.com/g/kubernetes-security-announce/c/nyfdhK24H7s
WEBhttps://security.netapp.com/advisory/ntap-20211008-0006