id: GO-2024-3286
modules:
    - module: k8s.io/kubernetes
      versions:
        - fixed: 1.28.12
        - introduced: 1.29.0
        - fixed: 1.29.7
        - introduced: 1.30.0
        - fixed: 1.30.3
      vulnerable_at: 1.30.2
      packages:
        - package: k8s.io/kubernetes/pkg/volume/git_repo
          symbols:
            - validateVolume
summary: Kubernetes kubelet arbitrary command execution in k8s.io/kubernetes
cves:
    - CVE-2024-10220
ghsas:
    - GHSA-27wf-5967-98gx
references:
    - advisory: https://github.com/advisories/GHSA-27wf-5967-98gx
    - web: http://www.openwall.com/lists/oss-security/2024/11/20/1
    - web: https://github.com/kubernetes/kubernetes/commit/1ab06efe92d8e898ca1931471c9533ce94aba29b
    - web: https://github.com/kubernetes/kubernetes/issues/128885
    - web: https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko
source:
    id: GHSA-27wf-5967-98gx
    created: 2024-12-13T09:59:18.294847-05:00
review_status: REVIEWED