CVE-2021-36779: Host operations allowed in privileged Longhorn managed pods
First published: Fri Dec 17 2021(Updated: )
A Missing Authentication for Critical Function vulnerability in SUSE Longhorn allows any workload in the cluster to execute any binary present in the image on the host without authentication. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3.
Credit: meissner@suse.de
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Longhorn | <1.1.3 | |
| Longhorn | >=1.2.0<1.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-36779?
CVE-2021-36779 has a high severity rating due to the potential for unauthorized execution of binaries on the host system.
How do I fix CVE-2021-36779?
To fix CVE-2021-36779, upgrade SUSE Longhorn to version 1.1.3 or later.
What systems are affected by CVE-2021-36779?
CVE-2021-36779 affects SUSE Longhorn versions prior to 1.1.3 and versions between 1.2.0 and 1.2.3.
What is the impact of CVE-2021-36779?
The impact of CVE-2021-36779 is that it allows any workload in the cluster to execute any binary on the host without authentication.
Is CVE-2021-36779 a remote or local vulnerability?
CVE-2021-36779 is considered a local vulnerability as it requires access to the cluster to exploit.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/author
- agent/title
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/linuxfoundation
- canonical/longhorn
- version/longhorn/1.2.0