Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                             CERT-Renater

                  Note d'Information No. 2025/VULN008

_____________________________________________________________________

DATE                : 17/01/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Kubelet versions prior to
                         1.32.1, 1.31.5, 1.30.9, 1.29.13.

=====================================================================
https://discuss.kubernetes.io/t/security-advisory-cve-2024-9042-command-injection-affecting-windows-nodes-via-nodes-logs-query-api/31276
_____________________________________________________________________

[Security Advisory] CVE-2024-9042: Command Injection affecting
Windows nodes via nodes/*/logs/query API

Announcements
SaranBalaji January 15, 2025, 10:23pm 1

Hello Kubernetes Community,

A security vulnerability has been discovered in Kubernetes windows
nodes that could allow a user with the ability to query a node’s
‘/logs’ endpoint to execute arbitrary commands on the host.

This issue has been rated Medium with a CVSS v3.1 score of 5.9
(CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) and assigned
CVE-2024-9042.


Am I vulnerable?

This CVE affects only Windows worker nodes. Your worker node is
vulnerable to this issue if it is running one of the affected
versions listed below.


Affected Components

    Kubelet


Affected Versions

    v1.32.0
    v1.31.0 to v1.31.4
    v1.30.0 to v1.30.8
    <=v1.29.12


How do I mitigate this vulnerability?

To mitigate this vulnerability, you need to upgrade the Kubelet on
your Windows worker nodes to one of the fixed versions listed
below.


Fixed Versions

    v1.32.1
    v1.31.5
    v1.30.9
    v1.29.13


Detection

To detect whether this vulnerability has been exploited, you can
examine your cluster’s audit logs to search for node ‘logs’
queries with suspicious inputs.

If you find evidence that this vulnerability has been exploited,
please contact security@kubernetes.io


Acknowledgements

This vulnerability was reported by Peled, Tomer and mitigated by
Aravindh Puthiyaprambil.


Thank You,

Balaji on behalf of the Kubernetes Security Response Committee


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================