VDB
BDU%3A2024-10035
BDU%3A2024-10035
PUBLISHED
CVSS 8.100000381469727 HIGH
Уязвимость программного средства управления кластерами виртуальных машин Kubernetes, связанная с неверным ограничением имени пути к каталогу с ограниченным доступом, позволяющая выполнить произвольный код
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| ООО «Ред Софт», Google Inc | РЕД ОС (запись в едином реестре российских программ №3751), Kubernetes | |
| kubernetes | kubelet | 1.29.0, 1.30.0, 1.31.0 |
| Kubernetes | kubelet | 0, 1.29.0, 1.30.0 |
Timeline
- Nov 21, 2024 CVE Published
- Nov 21, 2024 PoC Published
- Nov 21, 2024 PoC Published
- Nov 22, 2024 PoC Published
- Nov 22, 2024 PoC Published
- Nov 25, 2024 PoC Published
- Nov 25, 2024 PoC Published
- Nov 29, 2024 PoC Published
- Dec 1, 2024 PoC Published
- Dec 17, 2024 PoC Published
- Sep 26, 2025 CVE Updated
- Dec 1, 2025 PoC Published
References
- https://discuss.kubernetes.io/t/security-advisory-cve-2024-10220-arbitrary-command-execution-through-gitrepo-volume/30571 url
- https://github.com/kubernetes/kubernetes/pull/124531 url
- https://github.com/kubernetes/kubernetes/issues/128885 issue
- https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko mailing-list
- http://www.openwall.com/lists/oss-security/2024/11/20/1 url
- https://redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-kubernetes-cve-2024-10220/?sphrase_id=592546 url
- https://github.com/mrk336/CVE-2024-10220-Kubernetes-gitRepo-Volume-Vulnerability url