CVE-2017-1002102

Name: CVE-2017-1002102
Creator: NVD / NIST
Published: 2018-03-13T17:29:00.28+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.03%

Last modified Jun 17, 2026

CVE-2017-1002102 is a vulnerability of currently unknown severity. In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.. EPSS estimates a 1.03% chance of exploitation in the next 30 days.

Description

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.

Metrics

EPSS Probability

1.03%

59.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Vendor	Product	Versions
Kubernetes	Kubernetes	>= 1.3.0, <= 1.3.10
Kubernetes	Kubernetes	>= 1.4.0, <= 1.4.12
Kubernetes	Kubernetes	>= 1.5.0, <= 1.5.8
Kubernetes	Kubernetes	>= 1.6.0, <= 1.6.13
Kubernetes	Kubernetes	>= 1.7.0, < 1.7.14
Kubernetes	Kubernetes	>= 1.8.0, < 1.8.9
Kubernetes	Kubernetes	>= 1.9.0, < 1.9.4

References

https://access.redhat.com/errata/RHSA-2018:0475Third Party Advisory
https://github.com/kubernetes/kubernetes/issues/60814Issue Tracking, Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0475Third Party Advisory
https://github.com/kubernetes/kubernetes/issues/60814Issue Tracking, Vendor Advisory

Timeline

Published: Mar 13, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-1002102?

How severe is CVE-2017-1002102?

Severity scoring for CVE-2017-1002102 is pending analysis. The EPSS model estimates a 1.03% probability of exploitation in the next 30 days.

How do I fix CVE-2017-1002102?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-1002102?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST