Alpine: multiple k3s packages: security update to 0.7.0-r0 (deprecated)

high Tenable Self-Hosted Container Security Plugin ID 400525

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request
is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are
enforced using roles and role bindings within the namespace, meaning that a user with access only to a
resource in one namespace could create, view update or delete the cluster-scoped resource (according to
their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions
prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12. (CVE-2019-11247)

- The kubectl cp command allows copying files between containers and the user machine. To copy files from a
container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network,
and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could
run any code and output unexpected, malicious results. An attacker could use this to write files to any
path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local
user. Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions
prior to 1.15.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.
(CVE-2019-11249)

Plugin Details

Severity: High

ID: 400525

Version: Revision 1.23

Type: Local

Family: Alpine Linux Local Security Checks

Published: 8/16/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.04

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2019-11247

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/5/2019

Vulnerability Publication Date: 8/5/2019

Reference Information

CVE: CVE-2019-11247, CVE-2019-11249

Detections

Analytics