CVE-2021-25741
CVE-2021-25741 · Symlink Exchange Can Allow Host Filesystem Access
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.
CVSS 8.8 · High · EPSS 8.0% · Fix available
- Published
- Updated
Stack: system · containers
Affected products and versions
kubernetes
- Versions
- ≥ unspecified, ≤ 1.19.14: Affected (custom)
- ≥ unspecified, ≤ 1.20.10: Affected (custom)
- ≥ unspecified, ≤ 1.21.4: Affected (custom)
- ≥ unspecified, ≤ 1.22.1: Affected (custom)
No fix published
kubernetes Debian:12
- Affected ranges
- ECOSYSTEM: < 1.20.5+really1.20.2-1
Update to 1.20.5+really1.20.2-1
kubernetes Debian:13
- Affected ranges
- ECOSYSTEM: < 1.20.5+really1.20.2-1
Update to 1.20.5+really1.20.2-1
kubernetes Debian:14
- Affected ranges
- ECOSYSTEM: < 1.20.5+really1.20.2-1
Update to 1.20.5+really1.20.2-1