Approved changes feed: RSS · Atom
cpe:2.3:a:kubevirt:kubevirt:1.6.0:*:*:*:*:kubernetes:*:*
part: a version: 1.6.0 update: *
| Vendor | Kubevirt (4dbb168e-0148-5161-8366-0017a2d848a6) |
|---|---|
| Product | Kubevirt (7ace620e-59fb-507c-99ea-2486c6f4aacc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | kubernetes |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-64437 |
vulnerable | 2026-06-08 07:39:19.665458 |
KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes
MEDIUM (5)
KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock is a symlink or a regular file. This oversight can be exploited, for example, to change the ownership of arbitrary files on the host node to the unprivileged user with UID 107 (the same user used by virt-launcher) thus, compromising the CIA (Confidentiality, Integrity and Availability) of data on the host. To successfully exploit this vulnerability, an attacker should be in control of the file system of the virt-launcher pod. This vulnerability is fixed in 1.5.3 and 1.6.1.
Published: 2025-11-07T23:04:10.913Z
Updated: 2025-11-10T18:50:16.445Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64434 |
vulnerable | 2026-06-08 07:39:19.658345 |
KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing
MEDIUM (4.7)
KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler (via verifyPeerCert), an attacker who compromises a virt-handler instance, could exploit these shared credentials to impersonate virt-api and execute privileged operations against other virt-handler instances potentially compromising the integrity and availability of the VM managed by it. This vulnerability is fixed in 1.5.3 and 1.6.1.
Published: 2025-11-07T22:54:04.772Z
Updated: 2025-11-10T19:03:26.345Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.