WIP: Add doc for CVE-2017-14491

docs/advisories/cve_2017_14491.md

@@ -0,0 +1,41 @@
+# CVE-2017-14491
+
+A vulnerability in dnsmasq, used by kube-dns, requires an upgrade to the kube-dns component.
+
+[More details](https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html)
+
+## Fixed in kops versions:
+
+Not yet released.  Fixed by @mikesplain in [#3511](https://github.com/kubernetes/kops/pull/3511)
+
+## Hotfix for Kubernetes
+
+The minimal fix is to just update the image for the dnsmasq pod:
+
+```
+kubectl set image deployment/kube-dns -n kube-system dnsmasq=gcr.io/google_containers/k8s-dns-dnsmasq-amd64:1.14.5
+```
+
+
+Validate the change was applied to the deployment:
+```
+kubectl get deployment -n kube-system kube-dns -o jsonpath='{.spec.template.spec.containers[?(@.name == "dnsmasq")].image}'
+```
+
+To verify that pods were deployed:
+```
+kubectl get pods -n kube-system -o custom-columns=NAME:.metadata.name,IMAGE:.spec.containers[*].image -l k8s-app=kube-dns
+```
+
+
+You should see version 1.14.5 for the k8s-dns-dnsmasq-nanny-amd64 pod:
+
+```
+NAME                        IMAGE
+kube-dns-1100866048-3lqm0   gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.5,gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.5,gcr.io/google_containers/k8s-dns-sidecar-amd64:1.14.5
+kube-dns-1100866048-tjlv2   gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.5,gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.5,gcr.io/google_containers/k8s-dns-sidecar-amd64:1.14.5
+```
+
+## Thanks
+
+Thanks to @mikesplain, @chrislovecnm, @snoby, @justinsb, @3h4x