ClusterVulnerabilityReport
An instance of the ClusterVulnerabilityReport represents the latest vulnerabilities found in kubernetes cluster control-plane and node components. It consists of a list of control-plane and node components vulnerabilities with a summary of vulnerabilities grouped by severity. ClusterVulnerabilityReports are based on CVEs from the K8s vulnerability advisory.
The following listing shows a sample ClusterVulnerabilityReport associated with the kind cluster v1.21.1
apiVersion: aquasecurity.github.io/v1alpha1
kind: ClusterVulnerabilityReport
metadata:
annotations:
trivy-operator.aquasecurity.github.io/report-ttl: 24h0m0s
creationTimestamp: "2023-11-30T08:29:43Z"
generation: 1
labels:
resource-spec-hash: 6b5887445b
trivy-operator.container.name: k8s-cluster
trivy-operator.resource.kind: ClusterSbomReport
trivy-operator.resource.name: 584b5cdcd5
trivy-operator.resource.namespace: ""
name: clustersbomreport-584b5cdcd5-k8s-cluster
ownerReferences:
- apiVersion: aquasecurity.github.io/v1alpha1
blockOwnerDeletion: false
controller: true
kind: ClusterSbomReport
name: 584b5cdcd5
uid: 6b8a7458-696e-48fd-9aee-fd6747d25c42
resourceVersion: "2487"
uid: d7124d11-e744-4e10-97e3-dd03f84fd0b4
report:
artifact:
repository: kubernetes
tag: 1.21.1
os:
eosl: true
family: ubuntu
name: "21.04"
registry:
server: k8s.io
scanner:
name: Trivy
vendor: Aqua Security
version: 0.50.2
summary:
criticalCount: 0
highCount: 4
lowCount: 2
mediumCount: 9
noneCount: 0
unknownCount: 0
updateTimestamp: "2023-11-30T08:29:42Z"
vulnerabilities:
- fixedVersion: 1.5.9
installedVersion: 1.5.2
lastModifiedDate: "2023-11-07T03:39:00Z"
links: []
primaryLink: https://avd.aquasec.com/nvd/cve-2021-43816
publishedDate: "2022-01-05T19:15:00Z"
resource: github.com/containerd/containerd
score: 9.1
severity: HIGH
target: ""
title: Unprivileged pod may bind mount any privileged regular file on disk
vulnerabilityID: CVE-2021-43816
- fixedVersion: 1.4.13, 1.5.10, 1.6.1
installedVersion: 1.5.2
lastModifiedDate: "2023-11-07T03:44:00Z"
links: []
primaryLink: https://avd.aquasec.com/nvd/cve-2022-23648
publishedDate: "2022-03-03T14:15:00Z"
resource: github.com/containerd/containerd
score: 7.5
severity: HIGH
target: ""
title: 'containerd: insecure handling of image volumes'
vulnerabilityID: CVE-2022-23648
- fixedVersion: 1.4.8, 1.5.4
installedVersion: 1.5.2
lastModifiedDate: "2023-11-07T03:35:00Z"
links: []
primaryLink: https://avd.aquasec.com/nvd/cve-2021-32760
publishedDate: "2021-07-19T21:15:00Z"
resource: github.com/containerd/containerd
score: 6.3
severity: MEDIUM
target: ""
title: pulling and extracting crafted container image may result in Unix file
permission changes
vulnerabilityID: CVE-2021-32760
- fixedVersion: 1.4.11, 1.5.7
installedVersion: 1.5.2
lastModifiedDate: "2023-11-07T03:38:00Z"
links: []
primaryLink: https://avd.aquasec.com/nvd/cve-2021-41103
publishedDate: "2021-10-04T17:15:00Z"
resource: github.com/containerd/containerd
score: 7.8
severity: MEDIUM
target: ""
title: insufficiently restricted permissions on container root and plugin directories
vulnerabilityID: CVE-2021-41103
- fixedVersion: 1.5.16, 1.6.12
installedVersion: 1.5.2
lastModifiedDate: "2023-11-07T03:44:00Z"
links: []
primaryLink: https://avd.aquasec.com/nvd/cve-2022-23471
publishedDate: "2022-12-07T23:15:00Z"
resource: github.com/containerd/containerd
score: 6.5
severity: MEDIUM
target: ""
title: containerd is an open source container runtime. A bug was found in con
...
vulnerabilityID: CVE-2022-23471
- fixedVersion: 1.5.13, 1.6.6
installedVersion: 1.5.2
lastModifiedDate: "2023-11-07T03:47:00Z"
links: []
primaryLink: https://avd.aquasec.com/nvd/cve-2022-31030
publishedDate: "2022-06-09T14:15:00Z"
resource: github.com/containerd/containerd
score: 5.5
severity: MEDIUM
target: ""
title: containerd is an open source container runtime. A bug was found in the
...
vulnerabilityID: CVE-2022-31030
- fixedVersion: 1.5.18, 1.6.18
installedVersion: 1.5.2
lastModifiedDate: "2023-11-07T04:08:00Z"
links: []
primaryLink: https://avd.aquasec.com/nvd/cve-2023-25153
publishedDate: "2023-02-16T15:15:00Z"
resource: github.com/containerd/containerd
score: 5.5
severity: MEDIUM
target: ""
title: 'containerd: OCI image importer memory exhaustion'
vulnerabilityID: CVE-2023-25153
- fixedVersion: 1.5.18, 1.6.18
installedVersion: 1.5.2
lastModifiedDate: "2023-09-15T21:15:00Z"
links: []
primaryLink: https://avd.aquasec.com/nvd/cve-2023-25173
publishedDate: "2023-02-16T15:15:00Z"
resource: github.com/containerd/containerd
score: 7.8
severity: MEDIUM
target: ""
title: 'containerd: Supplementary groups are not set up properly'
vulnerabilityID: CVE-2023-25173
- fixedVersion: 1.4.12, 1.5.8
installedVersion: 1.5.2
lastModifiedDate: ""
links: []
primaryLink: https://github.com/advisories/GHSA-5j5w-g665-5m35
publishedDate: ""
resource: github.com/containerd/containerd
score: 3
severity: LOW
target: ""
title: Ambiguous OCI manifest parsing
vulnerabilityID: GHSA-5j5w-g665-5m35
- fixedVersion: 1.22.16, 1.23.14, 1.24.8, 1.25.4
installedVersion: 1.21.1
lastModifiedDate: "2023-05-11T15:15:00Z"
links: []
primaryLink: https://avd.aquasec.com/nvd/cve-2022-3162
publishedDate: "2023-03-01T19:15:00Z"
resource: k8s.io/apiserver
score: 6.5
severity: MEDIUM
target: ""
title: Unauthorized read of Custom Resources
vulnerabilityID: CVE-2022-3162
- fixedVersion: 1.24.15, 1.25.11, 1.26.6, 1.27.3
installedVersion: 1.21.1
lastModifiedDate: "2023-08-03T15:15:00Z"
links: []
primaryLink: https://avd.aquasec.com/nvd/cve-2023-2727
publishedDate: "2023-07-03T21:15:00Z"
resource: k8s.io/apiserver
score: 6.5
severity: MEDIUM
target: ""
title: Bypassing policies imposed by the ImagePolicyWebhook admission plugin
vulnerabilityID: CVE-2023-2727
- fixedVersion: 1.24.15, 1.25.11, 1.26.6, 1.27.3
installedVersion: 1.21.1
lastModifiedDate: "2023-08-03T15:15:00Z"
links: []
primaryLink: https://avd.aquasec.com/nvd/cve-2023-2728
publishedDate: "2023-07-03T21:15:00Z"
resource: k8s.io/apiserver
score: 6.5
severity: MEDIUM
target: ""
title: Bypassing enforce mountable secrets policy imposed by the ServiceAccount
admission plugin
vulnerabilityID: CVE-2023-2728
- fixedVersion: 1.19.16, 1.20.11, 1.21.5, 1.22.1
installedVersion: 1.21.1
lastModifiedDate: "2021-11-30T22:42:00Z"
links: []
primaryLink: https://avd.aquasec.com/nvd/cve-2021-25741
publishedDate: "2021-09-20T17:15:00Z"
resource: k8s.io/kubelet
score: 8.1
severity: HIGH
target: ""
title: Symlink exchange can allow host filesystem access
vulnerabilityID: CVE-2021-25741
- fixedVersion: 1.22.14, 1.23.11, 1.24.5
installedVersion: 1.21.1
lastModifiedDate: "2023-06-01T13:14:00Z"
links: []
primaryLink: https://avd.aquasec.com/nvd/cve-2021-25749
publishedDate: "2023-05-24T17:15:00Z"
resource: k8s.io/kubelet
score: 7.8
severity: HIGH
target: ""
title: runAsNonRoot logic bypass for Windows containers
vulnerabilityID: CVE-2021-25749
- fixedVersion: 1.24.14, 1.25.10, 1.26.5, 1.27.2
installedVersion: 1.21.1
lastModifiedDate: "2023-07-01T06:15:00Z"
links: []
primaryLink: https://avd.aquasec.com/nvd/cve-2023-2431
publishedDate: "2023-06-16T08:15:00Z"
resource: k8s.io/kubelet
score: 5.5
severity: LOW
target: ""
title: 'kubernetes: Bypass of seccomp profile enforcement'
vulnerabilityID: CVE-2023-2431