In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade kubernetes | Jul 30, 2024 | Dec 5, 2018 |
| Kubernetes | — | Upgrade Kubernetes to version 1.11.5Upgrade Kubernetes to version 1.10.11Upgrade Kubernetes to version 1.12.3Upgrade Kubernetes to version 1.13.0-rc.1 | Dec 4, 2018 | Dec 4, 2018 |
| Oracle_linux | — | Upgrade kubeadmUpgrade kubectlUpgrade kubelet | Dec 12, 2018 | Dec 5, 2018 |
| Redhat Openshift | — | Upgrade openshift-enterprise-cluster-capacityUpgrade cockpitUpgrade atomic-openshift-deschedulerUpgrade atomic-openshiftUpgrade golang-github-prometheus-node_exporterUpgrade atomic-openshift-dockerregistryUpgrade atomic-enterprise-service-catalogUpgrade openshift-monitor-sample-appUpgrade openshift-ansibleUpgrade openshift-monitor-project-lifecycleUpgrade atomic-openshift-node-problem-detectorUpgrade atomic-openshift-web-console | Dec 4, 2018 | Dec 3, 2018 |
| Suse | — | Upgrade kubernetes-nodeUpgrade kubernetes-schedulerUpgrade go1.14-docUpgrade go1.14Upgrade cri-o-kubeadm-criconfigUpgrade kubernetes-apiserverUpgrade kubernetes-kubelet1.18Upgrade kubernetes-proxyUpgrade cri-oUpgrade kubernetes-kubelet-commonUpgrade kubernetes-kubelet1.17Upgrade kubernetes-controller-managerUpgrade kubernetes-clientUpgrade cri-toolsUpgrade kubernetes-kubeadmUpgrade go1.14-raceUpgrade kubernetes-master | Apr 27, 2020 | Dec 5, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 5, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub