by Kastro
Paper/Archive/CVE-2021-36779

CVE-2021-36779

SUSE Longhorn — Host operations allowed in privileged Longhorn managed pods

EPSS 0.7%CVSS 9.6
critical.is priorityof 100
39
CVSS 9.6 (CNA, NVD agree)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 52.7.527 × 2010.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A Missing Authentication for Critical Function vulnerability in SUSE Longhorn allows any workload in the cluster to execute any binary present in the image on the host without authentication. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3.

Affected

ProductAffectedFixed inSource
Longhornlonghorn – < 1.1.31.1.3CNA
Longhornlonghorn – < 1.2.31.2.3CNA

Scores by source

NVD9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
suse (CNA)9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

refbugzilla.suse.com/show_bug.cgi?id=1191818refgithub.com/longhorn/longhorn/security/advisories/GHSA-g358-m2wp-mhhx