Detections
Analytics
Alpine: multiple k3s packages: security update to 1.18.6-r0 (deprecated)
medium Tenable Cloud Security Plugin ID 400356
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account
for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by
kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod.
If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node
and cause the node to fail. (CVE-2020-8557)
- The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6
are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to
escalate privileges from a node compromise to a full cluster compromise. (CVE-2020-8559)
See Also
https://git.alpinelinux.org/aports/commit/?id=43b93a123a8cd73d953a33c564b3f06c9fd5b14a
https://git.alpinelinux.org/aports/commit/?id=fb8b7878bf02bab5ff7075e6650bebde158317c6
Plugin Details
Severity: Medium
ID: 400356
Version: Revision 1.23
Type: Local
Published: 8/16/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 6.9
Percentile: 96.96
CVSS v2
Risk Factor: Medium
Base Score: 6
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSS Score Source: CVE-2020-8559
CVSS v3
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 6.1
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 7/17/2020
Vulnerability Publication Date: 7/15/2020
Reference Information
CVE: CVE-2020-8557, CVE-2020-8559