Jordan Zebor

**Name of the Vulnerable Software and Affected Versions** Kubernetes versions 1.8.x through 1.14.x **Description** The issue concerns the caching of schema information by kubectl, which is written with world-writeable permissions. If the cache directory is specified and located in a place accessible to other users or groups, the cached files can be modified, potentially disrupting kubectl operations. The cache directory defaults to $HOME/.kube/http-cache, but can be changed using the `--cache-dir` option. **Recommendations** For Kubernetes versions 1.8.x through 1.14.x, consider restricting access to the cache directory to prevent modifications by other users or groups. As a temporary workaround, avoid using a cache directory that is accessible to other users or groups.

**Name of the Vulnerable Software and Affected Versions** Node.js versions 8.x through 10.x **Description** The issue allows an attacker to cause a denial of service (DoS) by crashing a node server that provides an http2 server. This is achieved by interacting with the http2 server in a way that triggers a cleanup bug, where objects are used in native code after they are no longer available. **Recommendations** For Node.js versions 8.x through 10.x, update the http2 implementation to address the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Node.js versions 9.x through 10.x **Description** The issue allows an attacker to cause a denial of service (DoS) by crashing a node process that provides an http server supporting TLS server. This can be accomplished by sending duplicate or unexpected messages during the handshake. **Recommendations** For Node.js versions 9.x through 10.x, update the TLS implementation to address the issue.

**Name of the Vulnerable Software and Affected Versions** nghttp2 versions 1.10.0 through 1.31.0 **Description** The issue is related to improper input validation in ALTSVC frame handling, which can cause a segmentation fault and lead to denial of service. This can be exploited via a network client. **Recommendations** For nghttp2 versions 1.10.0 through 1.31.0, update to version 1.31.1 or later to resolve the issue.