CVE-2021-36779: Host operations allowed in privileged Longhorn managed pods
First published: Fri Dec 17 2021(Updated: )
A Missing Authentication for Critical Function vulnerability in SUSE Longhorn allows any workload in the cluster to execute any binary present in the image on the host without authentication. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3.
Credit: meissner@suse.de
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linuxfoundation Longhorn | <1.1.3 | |
| Linuxfoundation Longhorn | >=1.2.0<1.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/author
- agent/title
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/linuxfoundation
- canonical/linuxfoundation longhorn
- version/linuxfoundation longhorn/1.2.0