Impact A bug was found in containerd where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs.

Patches This bug has been fixed in the following containerd versions:

2.3.2 2.2.5 2.1.9

Users should update to these versions to resolve the issue.

Workarounds Ensure that only trusted images and checkpoints are used.

Credits The containerd project would like to thank @gouldnicholas and @davidrxchester, Yuming Zhang and Song Li of Zhejiang University, Sangwon Ryu (@sangwon090), Henry Beberman (@hbeberman) of Microsoft, the GKE Security Team using Gemini, Anthropic Research, in collaboration with Claude, Robert Prast (@robertprast), Kyle Elliott (@kyle-elliott-tob) of Trail of Bits, and Zhenchen Wang (@Plucky923), who independently discovered and responsibly disclosed this issue in accordance with the containerd security policy.

For more information

If you have any questions or comments about this advisory:

Open an issue in containerd Email us at security@containerd.io

To report a security issue in containerd: Report a new vulnerability Email us at security@containerd.io

A security vulnerability has been discovered in Kubernetes windows nodes that could allow a user with the ability to query a node's '/logs' endpoint to execute arbitrary commands on the host. This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.

The kubernetes packages provide utilities for container cluster management.Kubernetes and its dependencies will no longer be updated through the Extras channel. Instead, the Red Hat customers are advised to use Red Hat's supported Kubernetes-based products such as Red Hat OpenShift Container Platform.Components impacted by this change include the following deprecated Kubernetes RPM packages, images, and associated documentation:RPM Packages: kubernetes kubernetes-devel kubernetes-client kubernetes-master kubernetes-node kubernetes-unit-test cadvisor Container Images: registry.access.redhat.com/rhel7/kubernetes-apiserver registry.access.redhat.com/rhel7/kubernetes-controller-mgr registry.access.redhat.com/rhel7/kubernetes-scheduler Documentation: The "Getting Started with Kubernetes" guide linked from the References section. Additional information and guidance are provided in the Red Hat Enterprise Linux Atomic Host 7.5 Release Notes linked from the References section.