From decb03117c62f1fb677c18cff89d02d7b310a688 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 13 Mar 2025 21:25:51 +0000 Subject: [PATCH] Publish Advisories GHSA-vv39-3w5q-974q GHSA-vv39-3w5q-974q --- .../GHSA-vv39-3w5q-974q.json | 143 ++++++++++++++++++ .../GHSA-vv39-3w5q-974q.json | 44 ------ 2 files changed, 143 insertions(+), 44 deletions(-) create mode 100644 advisories/github-reviewed/2025/03/GHSA-vv39-3w5q-974q/GHSA-vv39-3w5q-974q.json delete mode 100644 advisories/unreviewed/2025/03/GHSA-vv39-3w5q-974q/GHSA-vv39-3w5q-974q.json diff --git a/advisories/github-reviewed/2025/03/GHSA-vv39-3w5q-974q/GHSA-vv39-3w5q-974q.json b/advisories/github-reviewed/2025/03/GHSA-vv39-3w5q-974q/GHSA-vv39-3w5q-974q.json new file mode 100644 index 00000000000..a4e39a4d9aa --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-vv39-3w5q-974q/GHSA-vv39-3w5q-974q.json @@ -0,0 +1,143 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vv39-3w5q-974q", + "modified": "2025-03-13T21:24:13Z", + "published": "2025-03-13T18:32:22Z", + "aliases": [ + "CVE-2024-9042" + ], + "summary": "Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API", + "details": "A security vulnerability has been discovered in Kubernetes windows nodes that could allow a user with the ability to query a node's '/logs' endpoint to execute arbitrary commands on the host. This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/kubernetes" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.29.13" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/kubernetes" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.30.0-alpha.0" + }, + { + "fixed": "1.30.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/kubernetes" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.31.0-alpha.0" + }, + { + "fixed": "1.31.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/kubernetes" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.32.0-alpha.0" + }, + { + "fixed": "1.32.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9042" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/issues/129654" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/commit/45f4ccc2153bbb782253704cbe24c05e22b5d60c" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/commit/5fe148234f8ab1184f26069c4f7bef6c37efe347" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/commit/75c83a6871dc030675288c6d63c275a43c2f0d55" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/commit/fb0187c2bf7061258bb89891edb1237261eb7abc" + }, + { + "type": "PACKAGE", + "url": "https://github.com/kubernetes/kubernetes" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/kubernetes-security-announce/c/9C3vn6aCSVg" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/01/16/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20", + "CWE-77" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-13T21:24:12Z", + "nvd_published_at": "2025-03-13T17:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-vv39-3w5q-974q/GHSA-vv39-3w5q-974q.json b/advisories/unreviewed/2025/03/GHSA-vv39-3w5q-974q/GHSA-vv39-3w5q-974q.json deleted file mode 100644 index e5c55df7205..00000000000 --- a/advisories/unreviewed/2025/03/GHSA-vv39-3w5q-974q/GHSA-vv39-3w5q-974q.json +++ /dev/null @@ -1,44 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-vv39-3w5q-974q", - "modified": "2025-03-13T18:32:22Z", - "published": "2025-03-13T18:32:22Z", - "aliases": [ - "CVE-2024-9042" - ], - "details": "This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9042" - }, - { - "type": "WEB", - "url": "https://github.com/kubernetes/kubernetes/issues/129654" - }, - { - "type": "WEB", - "url": "https://groups.google.com/g/kubernetes-security-announce/c/9C3vn6aCSVg" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2025/01/16/1" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-13T17:15:34Z" - } -} \ No newline at end of file