CVE-2020-1701
Medium
Description
A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. An attacker with access to create VMs could attach any secret within their namespace, allowing them to read the contents of that secret.
SeverityMedium
CVSS6.5
Exploit probability—
ProductKubevirt
PublishedMay 27, 2021
First seenMay 27, 2021
Weakness typeCWE-732CWE-732
How to fix
Update
- kubevirt kubevirt0.26.0 or later
- kubevirt.io/kubevirt0.26.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kubevirt kubevirt | v < 0.26.0 | 0.26.0 |
| kubevirt.io/kubevirtGo | v < 0.26.0 | 0.26.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.