Google Kubernetes Engine vulnerabilities

2 CVEs affecting Google Kubernetes Engine, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-10365, published 2019-07-31.

More from Google.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-5736, published 2019-02-11. High severity, CVSS 8.6. EPSS: 98.5% chance of exploitation in the next 30 days. runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to…
• CVE-2019-10365, published 2019-07-31. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read…