p PatchFirst

CVE-2024-10220

CVE-2024-10220 · Arbitrary command execution through gitRepo volume

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

CVSS 8.1 · High · EPSS 3.0% · Fix available

Published
Updated

Stack: system · containers

Affected products and versions

  • kubernetes

    Versions
    • ≥ 0, ≤ 1.28.11: Affected (semver)
    • ≥ 1.29.0, ≤ 1.29.6: Affected (semver)
    • ≥ 1.30.0, ≤ 1.30.2: Affected (semver)
    • 1.31.0: Not affected (semver)
    • 1.30.3: Not affected
    • 1.29.7: Not affected
    • 1.28.12: Not affected

    No fix published

  • kubernetes Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.20.5+really1.20.2-1

    Update to 1.20.5+really1.20.2-1

  • kubernetes Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.20.5+really1.20.2-1

    Update to 1.20.5+really1.20.2-1

  • kubernetes Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.20.5+really1.20.2-1

    Update to 1.20.5+really1.20.2-1

Original sources

Check your server →