Debian/kubernetes: medium 5.9
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod.
Action: Upgrade kubernetes to 1.20.5+really1.20.2-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.20.5+really1.20.2-1 | - |
Fixed versions
| 1.20.5+really1.20.2-1 |
Sources
published · modified · JSON