k3s vulnerabilities (Alpine)
15 vulnerabilities.
-
k3sAlpine Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin 5.9 Medium -
k3sAlpine K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack 7.5 High -
k3sAlpine Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin 6.5 Medium -
k3sAlpine K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token 6.5 Medium -
k3sAlpine Validating Admission Webhook does not observe some previous fields 6.5 Medium -
k3sAlpine mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs 8.5 High -
k3sAlpine environment variable leak 6.3 Medium -
k3sAlpine containerd-shim API Exposed to Host Network Containers 5.2 Medium -
k3sAlpine Kubernetes node disk Denial of Service by writing to container /etc/hosts 5.5 Medium -
k3sAlpine Privilege escalation from compromised node to cluster 6.4 Medium -
k3sAlpine Kubernetes kube-controller-manager SSRF 6.3 Medium -
k3sAlpine containernetworking/plugins vulnerable to MitM attacks 6.0 Medium -
k3sAlpine Kubernetes kube-apiserver allows access to custom resources via wrong scope 5.0 Medium -
k3sAlpine Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service 7.5 High -
k3sAlpine Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service 7.5 High