CVE-2018-1000400
High
Description
Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via container execution. This vulnerability appears to have been fixed in 1.9.
SeverityHigh
CVSS8.8
Exploit probability—
ProductKubernetes Cri-o
PublishedMay 18, 2018
First seenMay 18, 2018
How to fix
Update
- kubernetes cri-o1.9.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kubernetes cri-o | v < 1.9.0 | 1.9.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.