kubelet: Command Injection affecting Windows nodes via nodes/*/logs/query API
Published Mar 13, 2025
5.9
MEDIUMCVSS 3.1
EPSS 1.40%
Description
This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.
Affected products
-
- Version <=v1.29.12StatusaffectedConstraints-
- Version v1.30StatusaffectedConstraints<=v1.30.8
- Version v1.31StatusaffectedConstraints<=v1.31.4
- Version v1.32StatusaffectedConstraints<=v1.32.0
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Kubernetes | Kubelet | unaffected |
|
No data.
No data.
OpenShift Windows Machine Config Operator 10.16
openshift4-wincw/windows-machine-config-rhel9-operator:v10.16.2-1749241361
Fixed · RHSA-2025:9136
OpenShift Windows Machine Config Operator 10.17
openshift4-wincw/windows-machine-config-rhel9-operator:9.6-1748967421
Fixed · RHSA-2025:8704
Red Hat OpenShift Container Platform 4
openshift
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| OpenShift Windows Machine Config Operator 10.16 | openshift4-wincw/windows-machine-config-rhel9-operator:v10.16.2-1749241361 | Fixed | RHSA-2025:9136 |
| OpenShift Windows Machine Config Operator 10.17 | openshift4-wincw/windows-machine-config-rhel9-operator:9.6-1748967421 | Fixed | RHSA-2025:8704 |
| Red Hat OpenShift Container Platform 4 | openshift | Fix deferred | n/a |
k8s.io/kubernetes
Go
Introduced 1.31.0-alpha.0 Fixed 1.31.5k8s.io/kubernetes
Go
Introduced 1.32.0-alpha.0 Fixed 1.32.1k8s.io/kubernetes
Go
Introduced 0 Fixed 1.29.13k8s.io/kubernetes
Go
Introduced 1.30.0-alpha.0 Fixed 1.30.9
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | k8s.io/kubernetes | 1.31.0-alpha.0 | 1.31.5 |
| Go | k8s.io/kubernetes | 1.32.0-alpha.0 | 1.32.1 |
| Go | k8s.io/kubernetes | 0 | 1.29.13 |
| Go | k8s.io/kubernetes | 1.30.0-alpha.0 | 1.30.9 |
Remediation
Red Hat statement
This CVE affects only Windows worker nodes. To detect whether this vulnerability has been exploited, you can examine your cluster's audit logs to search for node 'logs' queries with suspicious inputs.
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References (13)
- http://www.openwall.com/lists/oss-security/2025/01/16/1
- https://access.redhat.com/security/cve/CVE-2024-9042 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2337297 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-54053 Advisory
- https://github.com/advisories/GHSA-vv39-3w5q-974q Advisory
- https://github.com/kubernetes/kubernetes/commit/45f4ccc2153bbb782253704cbe24c05e22b5d60c
- https://github.com/kubernetes/kubernetes/commit/5fe148234f8ab1184f26069c4f7bef6c37efe347
- https://github.com/kubernetes/kubernetes/commit/75c83a6871dc030675288c6d63c275a43c2f0d55
- https://github.com/kubernetes/kubernetes/commit/fb0187c2bf7061258bb89891edb1237261eb7abc
- https://github.com/kubernetes/kubernetes/issues/129654
- https://groups.google.com/g/kubernetes-security-announce/c/9C3vn6aCSVg
- https://nvd.nist.gov/vuln/detail/CVE-2024-9042
- https://www.cve.org/CVERecord?id=CVE-2024-9042
Change history (0)
No recorded changes yet.