GHSA-6pcv-qqx4-mxm3

Source

https://github.com/advisories/GHSA-6pcv-qqx4-mxm3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6pcv-qqx4-mxm3/GHSA-6pcv-qqx4-mxm3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6pcv-qqx4-mxm3

Aliases

Published

2022-05-13T01:35:04Z

Modified

2024-08-20T20:58:33.372871Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Minikube RCE via DNS Rebinding

Details

In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem.

Database specific

{
    "nvd_published_at": "2018-12-05T21:29:00Z",
    "cwe_ids": [
        "CWE-352"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-21T21:47:33Z"
}

References

Affected packages

Go / k8s.io/minikube

Package

Name: k8s.io/minikube; View open source insights on deps.dev
Purl: pkg:golang/k8s.io/minikube

Affected ranges

Type: SEMVER
Events: Introduced

0.3.0

Last affected

0.29.0