« Volver al listado

CVE-2024-7598

Estado: AplazadaBaja (3.1)—

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Kubernetes — KubernetesAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-7598",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-7598",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-20T18:40:30.346304Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "jordan@liggitt.net",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.1,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "jordan@liggitt.net",
      "affectedData": [
        {
          "repo": "https://github.com/kubernetes/kubernetes",
          "vendor": "Kubernetes",
          "product": "kube-apiserver",
          "versions": [
            {
              "status": "affected",
              "version": "1.3.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "1.3.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-03-20T17:15:37.707",
  "references": [
    {
      "url": "https://github.com/kubernetes/kubernetes/issues/126587",
      "source": "jordan@liggitt.net"
    },
    {
      "url": "https://groups.google.com/g/kubernetes-security-announce/c/67D7UFqiPRc",
      "source": "jordan@liggitt.net"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/03/20/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "jordan@liggitt.net",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced."
    },
    {
      "lang": "es",
      "value": "Se detectó un problema de seguridad en Kubernetes donde un pod malicioso o comprometido podía eludir las restricciones de red impuestas por las políticas de red durante la eliminación de un espacio de nombres. El orden en que se eliminan los objetos durante la terminación de un espacio de nombres no está definido, y es posible que las políticas de red se eliminen antes que los pods que protegen. Esto puede provocar que los pods se ejecuten brevemente, pero que no se apliquen las políticas de red que deberían aplicarse a las conexiones hacia y desde ellos."
    }
  ],
  "lastModified": "2026-06-17T08:20:31.417",
  "sourceIdentifier": "jordan@liggitt.net"
}