In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade kubernetes | Jul 30, 2024 | Dec 5, 2018 |
| Kubernetes | — | Upgrade Kubernetes to version 1.11.5Upgrade Kubernetes to version 1.12.3Upgrade Kubernetes to version 1.13.0-rc.1Upgrade Kubernetes to version 1.10.11 | Dec 4, 2018 | Dec 4, 2018 |
| Oracle_linux | — | Upgrade kubectlUpgrade kubeletUpgrade kubeadm | Dec 12, 2018 | Dec 5, 2018 |
| Redhat Openshift | — | Upgrade openshift-enterprise-cluster-capacityUpgrade atomic-openshift-dockerregistryUpgrade atomic-openshift-deschedulerUpgrade cockpitUpgrade atomic-openshiftUpgrade golang-github-prometheus-node_exporterUpgrade atomic-enterprise-service-catalogUpgrade atomic-openshift-node-problem-detectorUpgrade atomic-openshift-web-consoleUpgrade openshift-monitor-project-lifecycleUpgrade openshift-monitor-sample-appUpgrade openshift-ansible | Dec 4, 2018 | Dec 3, 2018 |
| Suse | — | Upgrade kubernetes-clientUpgrade cri-oUpgrade kubernetes-controller-managerUpgrade kubernetes-masterUpgrade go1.14-raceUpgrade cri-toolsUpgrade kubernetes-kubelet1.17Upgrade kubernetes-kubeadmUpgrade kubernetes-kubelet-commonUpgrade kubernetes-kubelet1.18Upgrade kubernetes-nodeUpgrade kubernetes-apiserverUpgrade cri-o-kubeadm-criconfigUpgrade go1.14-docUpgrade kubernetes-schedulerUpgrade go1.14Upgrade kubernetes-proxy | Apr 27, 2020 | Dec 5, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 5, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub