CVE-2017-1002102
Kubernetes arbitrary file overwrite
7.1 HighFix available
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
1.10%Up 0.5 points since Apr 14, 2021
What each source reports
CVE List Score used
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.
- Record
CVE-2017-1002102- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
EUVDEUVD-2022-4588
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.
- Record
EUVD-2022-4588- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mm7g-f2gg-cw8g
Kubernetes arbitrary file overwrite
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.
- Record
GHSA-mm7g-f2gg-cw8g- CVSS 3.0
- 5.6 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.
- Record
CVE-2017-1002102- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H - CVSS 3.0
- 5.6 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N - CVSS 2.0
- 6.3 Medium
AV:L/AC:M/Au:N/C:N/I:C/A:C - Updated
- 2026-11-02
OSV
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.
- Record
CVE-2017-1002102- CVSS 3.0
- 5.6 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-1002102
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.
- Record
DEBIAN-CVE-2017-1002102- CVSS 3.0
- 5.6 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-mm7g-f2gg-cw8g
Kubernetes arbitrary file overwrite
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.
- Record
GHSA-mm7g-f2gg-cw8g- CVSS 3.0
- 5.6 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVRHSA-2018:0475
Red Hat Security Advisory: Red Hat OpenShift Container Platform security update
- Record
RHSA-2018:0475- CVSS 3.0
- 7.2 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGO-2023-1977 No score
Kubernetes can trigger deletion of arbitrary files from the nodes where containers are running in k8s.io/kubernetes
Kubernetes can trigger deletion of arbitrary files from the nodes where containers are running in k8s.io/kubernetes
- Record
GO-2023-1977- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15424-1 No score
govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250807T150727-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15424-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
k8s.io/kubernetesGo |
1.8.0 to 1.8.8 | 1.8.9 |
k8s.io/kubernetesGo |
1.9.0 to 1.9.3 | 1.9.4 |
k8s.io/kubernetesGo |
1.3.0 to 1.7.13 | 1.7.14 |
kubernetesDebian:12 |
before 1.7.16+dfsg-1 | 1.7.16+dfsg-1 |
kubernetesDebian:13 |
before 1.7.16+dfsg-1 | 1.7.16+dfsg-1 |
kubernetesDebian:14 |
before 1.7.16+dfsg-1 | 1.7.16+dfsg-1 |
k8s.io/kubernetesGo |
1.3.0 up to 1.7.14 | 1.7.14 |
k8s.io/kubernetesGo |
1.8.0 up to 1.8.9 | 1.8.9 |
k8s.io/kubernetesGo |
1.9.0 up to 1.9.4 | 1.9.4 |
k8s.io/kubernetesGo |
1.3.0 up to 1.7.14, 1.8.0 up to 1.8.9, 1.9.0 up to 1.9.4 | 1.7.141.8.91.9.4 |
Show 68 moreShow less
| Package | Affected | Fixed |
|---|---|---|
atomic-openshiftRed Hat:openshift:3.3::el7 From an advisory covering 2 CVEs |
before 0:3.3.1.46.11-1.git.4.e236015.el7 | 0:3.3.1.46.11-1.git.4.e236015.el7 |
atomic-openshift-clientsRed Hat:openshift:3.3::el7 From an advisory covering 2 CVEs |
before 0:3.3.1.46.11-1.git.4.e236015.el7 | 0:3.3.1.46.11-1.git.4.e236015.el7 |
atomic-openshift-clients-redistributableRed Hat:openshift:3.3::el7 From an advisory covering 2 CVEs |
before 0:3.3.1.46.11-1.git.4.e236015.el7 | 0:3.3.1.46.11-1.git.4.e236015.el7 |
atomic-openshift-docker-excluderRed Hat:openshift:3.3::el7 From an advisory covering 2 CVEs |
before 0:3.3.1.46.11-1.git.4.e236015.el7 | 0:3.3.1.46.11-1.git.4.e236015.el7 |
atomic-openshift-dockerregistryRed Hat:openshift:3.3::el7 From an advisory covering 2 CVEs |
before 0:3.3.1.46.11-1.git.4.e236015.el7 | 0:3.3.1.46.11-1.git.4.e236015.el7 |
atomic-openshift-excluderRed Hat:openshift:3.3::el7 From an advisory covering 2 CVEs |
before 0:3.3.1.46.11-1.git.4.e236015.el7 | 0:3.3.1.46.11-1.git.4.e236015.el7 |
atomic-openshift-masterRed Hat:openshift:3.3::el7 From an advisory covering 2 CVEs |
before 0:3.3.1.46.11-1.git.4.e236015.el7 | 0:3.3.1.46.11-1.git.4.e236015.el7 |
atomic-openshift-nodeRed Hat:openshift:3.3::el7 From an advisory covering 2 CVEs |
before 0:3.3.1.46.11-1.git.4.e236015.el7 | 0:3.3.1.46.11-1.git.4.e236015.el7 |
atomic-openshift-podRed Hat:openshift:3.3::el7 From an advisory covering 2 CVEs |
before 0:3.3.1.46.11-1.git.4.e236015.el7 | 0:3.3.1.46.11-1.git.4.e236015.el7 |
atomic-openshift-sdn-ovsRed Hat:openshift:3.3::el7 From an advisory covering 2 CVEs |
before 0:3.3.1.46.11-1.git.4.e236015.el7 | 0:3.3.1.46.11-1.git.4.e236015.el7 |
atomic-openshift-testsRed Hat:openshift:3.3::el7 From an advisory covering 2 CVEs |
before 0:3.3.1.46.11-1.git.4.e236015.el7 | 0:3.3.1.46.11-1.git.4.e236015.el7 |
tuned-profiles-atomic-openshift-nodeRed Hat:openshift:3.3::el7 From an advisory covering 2 CVEs |
before 0:3.3.1.46.11-1.git.4.e236015.el7 | 0:3.3.1.46.11-1.git.4.e236015.el7 |
atomic-openshiftRed Hat:openshift:3.4::el7 From an advisory covering 2 CVEs |
before 0:3.4.1.44.38-1.git.4.bb8df08.el7 | 0:3.4.1.44.38-1.git.4.bb8df08.el7 |
atomic-openshift-clientsRed Hat:openshift:3.4::el7 From an advisory covering 2 CVEs |
before 0:3.4.1.44.38-1.git.4.bb8df08.el7 | 0:3.4.1.44.38-1.git.4.bb8df08.el7 |
atomic-openshift-clients-redistributableRed Hat:openshift:3.4::el7 From an advisory covering 2 CVEs |
before 0:3.4.1.44.38-1.git.4.bb8df08.el7 | 0:3.4.1.44.38-1.git.4.bb8df08.el7 |
atomic-openshift-docker-excluderRed Hat:openshift:3.4::el7 From an advisory covering 2 CVEs |
before 0:3.4.1.44.38-1.git.4.bb8df08.el7 | 0:3.4.1.44.38-1.git.4.bb8df08.el7 |
atomic-openshift-dockerregistryRed Hat:openshift:3.4::el7 From an advisory covering 2 CVEs |
before 0:3.4.1.44.38-1.git.4.bb8df08.el7 | 0:3.4.1.44.38-1.git.4.bb8df08.el7 |
atomic-openshift-excluderRed Hat:openshift:3.4::el7 From an advisory covering 2 CVEs |
before 0:3.4.1.44.38-1.git.4.bb8df08.el7 | 0:3.4.1.44.38-1.git.4.bb8df08.el7 |
atomic-openshift-masterRed Hat:openshift:3.4::el7 From an advisory covering 2 CVEs |
before 0:3.4.1.44.38-1.git.4.bb8df08.el7 | 0:3.4.1.44.38-1.git.4.bb8df08.el7 |
atomic-openshift-nodeRed Hat:openshift:3.4::el7 From an advisory covering 2 CVEs |
before 0:3.4.1.44.38-1.git.4.bb8df08.el7 | 0:3.4.1.44.38-1.git.4.bb8df08.el7 |
atomic-openshift-podRed Hat:openshift:3.4::el7 From an advisory covering 2 CVEs |
before 0:3.4.1.44.38-1.git.4.bb8df08.el7 | 0:3.4.1.44.38-1.git.4.bb8df08.el7 |
atomic-openshift-sdn-ovsRed Hat:openshift:3.4::el7 From an advisory covering 2 CVEs |
before 0:3.4.1.44.38-1.git.4.bb8df08.el7 | 0:3.4.1.44.38-1.git.4.bb8df08.el7 |
atomic-openshift-testsRed Hat:openshift:3.4::el7 From an advisory covering 2 CVEs |
before 0:3.4.1.44.38-1.git.4.bb8df08.el7 | 0:3.4.1.44.38-1.git.4.bb8df08.el7 |
tuned-profiles-atomic-openshift-nodeRed Hat:openshift:3.4::el7 From an advisory covering 2 CVEs |
before 0:3.4.1.44.38-1.git.4.bb8df08.el7 | 0:3.4.1.44.38-1.git.4.bb8df08.el7 |
atomic-openshiftRed Hat:openshift:3.5::el7 From an advisory covering 2 CVEs |
before 0:3.5.5.31.48-1.git.4.ff6153e.el7 | 0:3.5.5.31.48-1.git.4.ff6153e.el7 |
atomic-openshift-clientsRed Hat:openshift:3.5::el7 From an advisory covering 2 CVEs |
before 0:3.5.5.31.48-1.git.4.ff6153e.el7 | 0:3.5.5.31.48-1.git.4.ff6153e.el7 |
atomic-openshift-clients-redistributableRed Hat:openshift:3.5::el7 From an advisory covering 2 CVEs |
before 0:3.5.5.31.48-1.git.4.ff6153e.el7 | 0:3.5.5.31.48-1.git.4.ff6153e.el7 |
atomic-openshift-docker-excluderRed Hat:openshift:3.5::el7 From an advisory covering 2 CVEs |
before 0:3.5.5.31.48-1.git.4.ff6153e.el7 | 0:3.5.5.31.48-1.git.4.ff6153e.el7 |
atomic-openshift-dockerregistryRed Hat:openshift:3.5::el7 From an advisory covering 2 CVEs |
before 0:3.5.5.31.48-1.git.4.ff6153e.el7 | 0:3.5.5.31.48-1.git.4.ff6153e.el7 |
atomic-openshift-excluderRed Hat:openshift:3.5::el7 From an advisory covering 2 CVEs |
before 0:3.5.5.31.48-1.git.4.ff6153e.el7 | 0:3.5.5.31.48-1.git.4.ff6153e.el7 |
atomic-openshift-masterRed Hat:openshift:3.5::el7 From an advisory covering 2 CVEs |
before 0:3.5.5.31.48-1.git.4.ff6153e.el7 | 0:3.5.5.31.48-1.git.4.ff6153e.el7 |
atomic-openshift-nodeRed Hat:openshift:3.5::el7 From an advisory covering 2 CVEs |
before 0:3.5.5.31.48-1.git.4.ff6153e.el7 | 0:3.5.5.31.48-1.git.4.ff6153e.el7 |
atomic-openshift-podRed Hat:openshift:3.5::el7 From an advisory covering 2 CVEs |
before 0:3.5.5.31.48-1.git.4.ff6153e.el7 | 0:3.5.5.31.48-1.git.4.ff6153e.el7 |
atomic-openshift-sdn-ovsRed Hat:openshift:3.5::el7 From an advisory covering 2 CVEs |
before 0:3.5.5.31.48-1.git.4.ff6153e.el7 | 0:3.5.5.31.48-1.git.4.ff6153e.el7 |
atomic-openshift-testsRed Hat:openshift:3.5::el7 From an advisory covering 2 CVEs |
before 0:3.5.5.31.48-1.git.4.ff6153e.el7 | 0:3.5.5.31.48-1.git.4.ff6153e.el7 |
tuned-profiles-atomic-openshift-nodeRed Hat:openshift:3.5::el7 From an advisory covering 2 CVEs |
before 0:3.5.5.31.48-1.git.4.ff6153e.el7 | 0:3.5.5.31.48-1.git.4.ff6153e.el7 |
atomic-openshiftRed Hat:openshift:3.6::el7 From an advisory covering 2 CVEs |
before 0:3.6.173.0.96-1.git.4.e6301f8.el7 | 0:3.6.173.0.96-1.git.4.e6301f8.el7 |
atomic-openshift-clientsRed Hat:openshift:3.6::el7 From an advisory covering 2 CVEs |
before 0:3.6.173.0.96-1.git.4.e6301f8.el7 | 0:3.6.173.0.96-1.git.4.e6301f8.el7 |
atomic-openshift-clients-redistributableRed Hat:openshift:3.6::el7 From an advisory covering 2 CVEs |
before 0:3.6.173.0.96-1.git.4.e6301f8.el7 | 0:3.6.173.0.96-1.git.4.e6301f8.el7 |
atomic-openshift-cluster-capacityRed Hat:openshift:3.6::el7 From an advisory covering 2 CVEs |
before 0:3.6.173.0.96-1.git.4.e6301f8.el7 | 0:3.6.173.0.96-1.git.4.e6301f8.el7 |
atomic-openshift-docker-excluderRed Hat:openshift:3.6::el7 From an advisory covering 2 CVEs |
before 0:3.6.173.0.96-1.git.4.e6301f8.el7 | 0:3.6.173.0.96-1.git.4.e6301f8.el7 |
atomic-openshift-dockerregistryRed Hat:openshift:3.6::el7 From an advisory covering 2 CVEs |
before 0:3.6.173.0.96-1.git.4.e6301f8.el7 | 0:3.6.173.0.96-1.git.4.e6301f8.el7 |
atomic-openshift-excluderRed Hat:openshift:3.6::el7 From an advisory covering 2 CVEs |
before 0:3.6.173.0.96-1.git.4.e6301f8.el7 | 0:3.6.173.0.96-1.git.4.e6301f8.el7 |
atomic-openshift-federation-servicesRed Hat:openshift:3.6::el7 From an advisory covering 2 CVEs |
before 0:3.6.173.0.96-1.git.4.e6301f8.el7 | 0:3.6.173.0.96-1.git.4.e6301f8.el7 |
atomic-openshift-masterRed Hat:openshift:3.6::el7 From an advisory covering 2 CVEs |
before 0:3.6.173.0.96-1.git.4.e6301f8.el7 | 0:3.6.173.0.96-1.git.4.e6301f8.el7 |
atomic-openshift-nodeRed Hat:openshift:3.6::el7 From an advisory covering 2 CVEs |
before 0:3.6.173.0.96-1.git.4.e6301f8.el7 | 0:3.6.173.0.96-1.git.4.e6301f8.el7 |
atomic-openshift-podRed Hat:openshift:3.6::el7 From an advisory covering 2 CVEs |
before 0:3.6.173.0.96-1.git.4.e6301f8.el7 | 0:3.6.173.0.96-1.git.4.e6301f8.el7 |
atomic-openshift-sdn-ovsRed Hat:openshift:3.6::el7 From an advisory covering 2 CVEs |
before 0:3.6.173.0.96-1.git.4.e6301f8.el7 | 0:3.6.173.0.96-1.git.4.e6301f8.el7 |
atomic-openshift-service-catalogRed Hat:openshift:3.6::el7 From an advisory covering 2 CVEs |
before 0:3.6.173.0.96-1.git.4.e6301f8.el7 | 0:3.6.173.0.96-1.git.4.e6301f8.el7 |
atomic-openshift-testsRed Hat:openshift:3.6::el7 From an advisory covering 2 CVEs |
before 0:3.6.173.0.96-1.git.4.e6301f8.el7 | 0:3.6.173.0.96-1.git.4.e6301f8.el7 |
tuned-profiles-atomic-openshift-nodeRed Hat:openshift:3.6::el7 From an advisory covering 2 CVEs |
before 0:3.6.173.0.96-1.git.4.e6301f8.el7 | 0:3.6.173.0.96-1.git.4.e6301f8.el7 |
atomic-openshiftRed Hat:openshift:3.7::el7 From an advisory covering 2 CVEs |
before 0:3.7.23-1.git.5.83efd71.el7 | 0:3.7.23-1.git.5.83efd71.el7 |
atomic-openshift-clientsRed Hat:openshift:3.7::el7 From an advisory covering 2 CVEs |
before 0:3.7.23-1.git.5.83efd71.el7 | 0:3.7.23-1.git.5.83efd71.el7 |
atomic-openshift-clients-redistributableRed Hat:openshift:3.7::el7 From an advisory covering 2 CVEs |
before 0:3.7.23-1.git.5.83efd71.el7 | 0:3.7.23-1.git.5.83efd71.el7 |
atomic-openshift-cluster-capacityRed Hat:openshift:3.7::el7 From an advisory covering 2 CVEs |
before 0:3.7.23-1.git.5.83efd71.el7 | 0:3.7.23-1.git.5.83efd71.el7 |
atomic-openshift-docker-excluderRed Hat:openshift:3.7::el7 From an advisory covering 2 CVEs |
before 0:3.7.23-1.git.5.83efd71.el7 | 0:3.7.23-1.git.5.83efd71.el7 |
atomic-openshift-dockerregistryRed Hat:openshift:3.7::el7 From an advisory covering 2 CVEs |
before 0:3.7.23-1.git.5.83efd71.el7 | 0:3.7.23-1.git.5.83efd71.el7 |
atomic-openshift-excluderRed Hat:openshift:3.7::el7 From an advisory covering 2 CVEs |
before 0:3.7.23-1.git.5.83efd71.el7 | 0:3.7.23-1.git.5.83efd71.el7 |
atomic-openshift-federation-servicesRed Hat:openshift:3.7::el7 From an advisory covering 2 CVEs |
before 0:3.7.23-1.git.5.83efd71.el7 | 0:3.7.23-1.git.5.83efd71.el7 |
atomic-openshift-masterRed Hat:openshift:3.7::el7 From an advisory covering 2 CVEs |
before 0:3.7.23-1.git.5.83efd71.el7 | 0:3.7.23-1.git.5.83efd71.el7 |
atomic-openshift-nodeRed Hat:openshift:3.7::el7 From an advisory covering 2 CVEs |
before 0:3.7.23-1.git.5.83efd71.el7 | 0:3.7.23-1.git.5.83efd71.el7 |
atomic-openshift-podRed Hat:openshift:3.7::el7 From an advisory covering 2 CVEs |
before 0:3.7.23-1.git.5.83efd71.el7 | 0:3.7.23-1.git.5.83efd71.el7 |
atomic-openshift-sdn-ovsRed Hat:openshift:3.7::el7 From an advisory covering 2 CVEs |
before 0:3.7.23-1.git.5.83efd71.el7 | 0:3.7.23-1.git.5.83efd71.el7 |
atomic-openshift-service-catalogRed Hat:openshift:3.7::el7 From an advisory covering 2 CVEs |
before 0:3.7.23-1.git.5.83efd71.el7 | 0:3.7.23-1.git.5.83efd71.el7 |
atomic-openshift-template-service-brokerRed Hat:openshift:3.7::el7 From an advisory covering 2 CVEs |
before 0:3.7.23-1.git.5.83efd71.el7 | 0:3.7.23-1.git.5.83efd71.el7 |
atomic-openshift-testsRed Hat:openshift:3.7::el7 From an advisory covering 2 CVEs |
before 0:3.7.23-1.git.5.83efd71.el7 | 0:3.7.23-1.git.5.83efd71.el7 |
tuned-profiles-atomic-openshift-nodeRed Hat:openshift:3.7::el7 From an advisory covering 2 CVEs |
before 0:3.7.23-1.git.5.83efd71.el7 | 0:3.7.23-1.git.5.83efd71.el7 |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 44 CVEs |
before 0.0.20250807T150727-1.1 | 0.0.20250807T150727-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-1002102 is a high vulnerability (CVSS 7.1) in Kubernetes, published March 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 65th percentile. Fixed in k8s.io/kubernetes 1.8.9.
References
access.redhat.com/errata/RHSA-2018:0475
github.com/kubernetes/kubernetes/issues/60814
nvd.nist.gov/vuln/detail/CVE-2017-1002102
security-tracker.debian.org/tracker/CVE-2017-1002102
Show 55 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1525130
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0475.json
cve.org/CVERecord?id=CVE-2017-1002101
suse.com/security/cve/CVE-2015-7561