x/vulndb: potential Go vuln in k8s.io/kubernetes: GHSA-mm7g-f2gg-cw8g

[GoVulnBot]

In GitHub Security Advisory GHSA-mm7g-f2gg-cw8g, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
k8s.io/kubernetes		>= 1.9.0, <= 1.9.3

Cross references:

• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in k8s.io/kubernetes: GHSA-qh36-44jv-c8xj #617 NOT_IMPORTABLE
• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in k8s.io/kubernetes/pkg/apiserver: GHSA-pmqp-h87c-mr78 #703 EFFECTIVELY_PRIVATE
• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in k8s.io/kubernetes/pkg/util/mount: GHSA-wqwf-x5cj-rg56 #886 NOT_IMPORTABLE
• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in k8s.io/kubernetes: CVE-2020-8561, GHSA-74j8-88mm-7496 #904 NOT_IMPORTABLE
• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in k8s.io/kubernetes: CVE-2021-25735, GHSA-g42g-737j-qx6j #907 NOT_IMPORTABLE
• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in k8s.io/kubernetes: CVE-2021-25737, GHSA-mfv7-gq43-w965 #908 NOT_IMPORTABLE
• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in k8s.io/kubernetes: CVE-2021-25740, GHSA-vw47-mr44-3jf9 #909 NOT_IMPORTABLE
• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in k8s.io/kubernetes: CVE-2021-25741, GHSA-f5f7-6478-qm6p #910 NOT_IMPORTABLE
• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in k8s.io/kubernetes: CVE-2020-8554, GHSA-j9wf-vvm6-4r9w #940 EFFECTIVELY_PRIVATE
• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in k8s.io/kubernetes/pkg/kubectl: CVE-2021-25743, GHSA-f9jg-8p32-2f55 #983 EFFECTIVELY_PRIVATE
• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in k8s.io/kubernetes: GHSA-2jx2-76rc-2v7v #1492 EFFECTIVELY_PRIVATE
• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in k8s.io/kubernetes: GHSA-xc8m-28vv-4pjc #1864 EFFECTIVELY_PRIVATE
• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in k8s.io/kubernetes: GHSA-qc2g-gmh6-95p4 #1891 NOT_IMPORTABLE
• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in k8s.io/kubernetes: GHSA-cgcv-5272-97pr #1892 NOT_IMPORTABLE
• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in k8s.io/kubernetes: GHSA-f4w6-3rh6-6q4q #1943 EFFECTIVELY_PRIVATE
• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in k8s.io/kubernetes: GHSA-q4rr-64r9-fwgf #1946 EFFECTIVELY_PRIVATE
• Module k8s.io/kubernetes appears in issue dummy issue #64
• Module k8s.io/kubernetes appears in issue dummy issue #65
• Module k8s.io/kubernetes appears in issue dummy issue #66
• Module k8s.io/kubernetes appears in issue x/vulndb: potential Go vuln in github.com/kubernetes/kubernetes: GHSA-jp32-vmm6-3vf5 #701

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: k8s.io/kubernetes
      versions:
        - introduced: TODO (earliest fixed "", vuln range ">= 1.9.0, <= 1.9.3")
      vulnerable_at: 1.27.4
      packages:
        - package: k8s.io/kubernetes
    - module: k8s.io/kubernetes
      versions:
        - introduced: TODO (earliest fixed "", vuln range ">= 1.8.0, <= 1.8.8")
      vulnerable_at: 1.27.4
      packages:
        - package: k8s.io/kubernetes
    - module: k8s.io/kubernetes
      versions:
        - introduced: TODO (earliest fixed "", vuln range ">= 1.7.0, <= 1.7.13")
      vulnerable_at: 1.27.4
      packages:
        - package: k8s.io/kubernetes
    - module: k8s.io/kubernetes
      versions:
        - introduced: TODO (earliest fixed "", vuln range ">= 1.3, < 1.7")
      vulnerable_at: 1.27.4
      packages:
        - package: k8s.io/kubernetes
summary: Kubernetes arbitrary file overwrite
description: |-
    In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14,
    1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI
    volume can trigger deletion of arbitrary files/directories from the nodes where
    they are running.
cves:
    - CVE-2017-1002102
ghsas:
    - GHSA-mm7g-f2gg-cw8g
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2017-1002102
    - report: https://github.com/kubernetes/kubernetes/issues/60814
    - web: https://access.redhat.com/errata/RHSA-2018:0475
    - advisory: https://github.com/advisories/GHSA-mm7g-f2gg-cw8g

[gopherbot]

Change https://go.dev/cl/514636 mentions this issue: data/excluded: batch add 31 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606789 mentions this issue: data/reports: unexclude 20 reports (9)