Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names (e.g., ../../../../etc/password) can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot. Mitigations Enable golang's built-in insecure path protections when restoring snapshots by setting theGODEBUG environment variable: Manually extract the snapshot from the zip archive before restoring it. If the snapshot to be restored does not end with .zip, the vulnerable extraction code will not be executed. Additional Notes Administrators should be aware of the cautions noted in the "Security" section of the documentation on Restoring Snapshots.
Recommended action: Upgrade to 1.35.3, 1.34.6 or 1.33.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/k3s-io/k3s >= 1.32.0-rc1, < 1.32.4-rc1
Fixed in
1.32.4-rc1· Vendor fix available
Issue
CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing credentials.
Recommended action: Upgrade to 1.32.4-rc1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
1.25.131.24.171.26.81.27.51.28.1· Vendor fix available
Issue
Impact An issue was found in K3s where an attacker with network access to K3s servers' apiserver/supervisor port (TCP 6443) can force the TLS server to add entries to the certificate's Subject Alternative Name (SAN) list, through a stuffing attack, until the certificate grows so large that it exceeds the maximum size allowed by TLS client implementations. OpenSSL for example will raise an excessive message size error when this occurs. No authentication is necessary to perform this attack, only the ability to perform a TLS handshake against the apiserver/supervisor port (TCP 6443). Affected servers will continue to operate, but clients (including both external administrative access with kubectl and server or agent nodes) will fail to establish new connections, thus leading to a denial of service (DoS) attack. Remediation Upgrade to a fixed release: - v1.28.1+k3s1 - v1.27.5+k3s1 - v1.26.8+k3s1 - v1.25.13+k3s1 - v1.24.17+k3s1 If you are using K3s 1.27 or earlier, you must also add the…
Recommended action: Upgrade to 1.28.1, 1.27.5, 1.26.8 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.