MEDIUM5.9
GHSA-vv39-3w5q-974q
Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API
Quick fix
GHSA-vv39-3w5q-974q — k8s.io/kubernetes: upgrade to the fixed version with the command below.
go get k8s.io/kubernetes@v1.29.13Details
A security vulnerability has been discovered in Kubernetes windows nodes that could allow a user with the ability to query a node's '/logs' endpoint to execute arbitrary commands on the host. This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/k8s.io/kubernetes
Introduced in:
1.30.0-alpha.0Fixed in: 1.30.9Fix
go get k8s.io/kubernetes@v1.30.9Go/k8s.io/kubernetes
Introduced in:
1.31.0-alpha.0Fixed in: 1.31.5Fix
go get k8s.io/kubernetes@v1.31.5Go/k8s.io/kubernetes
Introduced in:
1.32.0-alpha.0Fixed in: 1.32.1Fix
go get k8s.io/kubernetes@v1.32.1References
- https://nvd.nist.gov/vuln/detail/CVE-2024-9042[ADVISORY]
- https://github.com/kubernetes/kubernetes/issues/129654[WEB]
- https://github.com/kubernetes/kubernetes/commit/45f4ccc2153bbb782253704cbe24c05e22b5d60c[WEB]
- https://github.com/kubernetes/kubernetes/commit/5fe148234f8ab1184f26069c4f7bef6c37efe347[WEB]
- https://github.com/kubernetes/kubernetes/commit/75c83a6871dc030675288c6d63c275a43c2f0d55[WEB]
- https://github.com/kubernetes/kubernetes/commit/fb0187c2bf7061258bb89891edb1237261eb7abc[WEB]
- https://github.com/kubernetes/kubernetes[PACKAGE]
- https://groups.google.com/g/kubernetes-security-announce/c/9C3vn6aCSVg[WEB]
- http://www.openwall.com/lists/oss-security/2025/01/16/1[WEB]