Stay organized with collections
Save and categorize content based on your preferences.
Upgrading a cluster to the latest Google Distributed Cloud version brings added
features and fixes to your cluster. With each patch release, we fix numerous
security vulnerabilities which makes upgrading to the latest recommended patch
version
all the more important. Upgrading is a shared responsibility between Google and
the customer. For more information about shared responsibilities, see Shared
Responsibility Model
This page is for Security specialists who support the resolution of security
issues or vulnerabilities which need strategic assistance, such as incidents and
issues escalated from support. To learn more about common roles and example
tasks that we reference in Google Cloud content, see Common
GKE Enterprise user roles and
tasks.
How vulnerabilities are classified
Security vulnerabilities are usually identified through the Common
Vulnerabilities and Exposures (CVE) system. The
GKE Enterprise security team classifies vulnerabilities according
to the Kubernetes vulnerability
scoring
system. Classifications consider many factors including GKE,
GKE Enterprise, and Google Distributed Cloud configuration and
security hardening. Because of these factors and the investments Google Cloud
makes in security, these vulnerability classifications might differ from other
classification sources.
The following table describes vulnerability severity categories:
Severity
Description
Critical
A vulnerability easily exploitable in all clusters by an
unauthenticated remote attacker that leads to full system compromise.
High
A vulnerability easily exploitable for many clusters that leads to
loss of confidentiality, integrity, or availability.
Medium
A vulnerability exploitable for some clusters where loss of
confidentiality, integrity, or availability is limited by common
configurations, difficulty of the exploit itself, required access, or user
interaction.
Low
All other container vulnerabilities. Exploitation is unlikely or consequences of
exploitation are limited.
Security bulletins
Most vulnerabilities are fixed in supported versions of Google Distributed Cloud
before they can be exploited. When there are reported incidents that have the
potential to compromise the security of your clusters and data, we publish
security bulletins. A security bulletin describes the security issue and its
impact and provides a mitigation. For more information and a list of published
bulletins, see the Security
bulletins page.
When a security bulletin is published for a vulnerability that affects
Google Distributed Cloud (software only) on VMware, we publish a corresponding
release note with a link to the bulletin.
Fixed vulnerabilities by Google Distributed Cloud patch version
The following table lists all vulnerabilities that have been fixed, starting in
January 2025. For older fixes, see the release
notes. The fixes in the following table are listed
by Google Distributed Cloud release version and severity:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-01-15 UTC."],[],[]]
