CVE-2024-9042: Command Injection affecting Windows nodes via nodes/*/logs/query API
Open
action-required
- Dominant language
- TypeScript
- Stars
- 2.1k
- Forks
- 395
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 13
Description
More here : https://github.com/kubernetes/kubernetes/issues/129654
Essentially this CVE impacts the kubelet feature "NodeLogQuery", which is not enabled on AKS clusters, hence there is no direct risk for existing Windows node pools. The fix has been backported to supported Kubernetes versions and will be available soon
Contributor guide
Assessment
This issue has not been assessed yet.