漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
OS Command Injection for Fluid Users with JuicefsRuntime
Vulnerability Description
Fluid is an open source Kubernetes-native Distributed Dataset Orchestrator and Accelerator for data-intensive applications. An OS command injection vulnerability within the Fluid project's JuicefsRuntime can potentially allow an authenticated user, who has the authority to create or update the K8s CRD Dataset/JuicefsRuntime, to execute arbitrary OS commands within the juicefs related containers. This could lead to unauthorized access, modification or deletion of data. Users who're using versions < 0.9.3 with JuicefsRuntime should upgrade to v0.9.3.
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Vulnerability Title
Fluid 安全漏洞
Vulnerability Description
Fluid是Cloud Native Computing Foundation基金会的一个开源的 Kubernetes 原生分布式数据集编排器和加速器，适用于大数据和 AI 应用程序等数据密集型应用程序。 Fluid v0.9.3之前版本存在安全漏洞。攻击者利用该漏洞在 Juicefs 相关容器中执行任意操作系统命令。
CVSS Information
N/A
Vulnerability Type
N/A