PatchTheCVEtrident vulnerabilities and fixes
Recent CVEs affecting trident, with upgrade or downgrade steps. 11 tracked.
trident has 11 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 10. Most recent: 2021-10-29. Highest priority: CVE-2018-1002105 (score 74/100).
- CVE-2021-34558 MEDIUM 6.5 UPGRADE MITIGATE The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 c
- CVE-2021-25742 HIGH 7.6 UPGRADE MITIGATE A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can us
- CVE-2020-29511 CRITICAL 9.8 UPGRADE MITIGATE The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace p
- CVE-2020-29510 CRITICAL 9.8 UPGRADE MITIGATE The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directiv
- CVE-2020-29509 CRITICAL 9.8 UPGRADE MITIGATE The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace
- CVE-2020-28366 HIGH 7.5 UPGRADE MITIGATE Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at b
- CVE-2020-28362 HIGH 7.5 UPGRADE MITIGATE Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
- CVE-2019-11244 MEDIUM 5.0 UPGRADE MITIGATE In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defau
- CVE-2019-11243 HIGH 8.1 UPGRADE MITIGATE In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provi
- CVE-2018-1002105 CRITICAL 9.8 UPGRADE DOWNGRADE In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to p
- CVE-2018-1000133 HIGH 7.5 DOWNGRADE Pitchfork version 1.4.6 RC1 contains an Improper Privilege Management vulnerability in Trident Pitchfork compo
FAQ
How do I fix trident vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is trident being exploited right now?
None of the tracked trident CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which trident CVE should I patch first?
CVE-2018-1002105 currently ranks highest (74/100): In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to p.