CVE-2021-25735

Validating Admission Webhook does not observe some previous fields

A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.

CVSS 3.1 · 6.5 Medium EPSS 5.4% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2020-8566

Ceph RBD adminSecrets exposed in logs when loglevel >= 4

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2020-8565

Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift Container Storage Openshift Data Foundation

CVE-2020-8564

Docker config secrets leaked when file is malformed and loglevel >= 4

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2020-8563

Secret leaks in logs for vSphere Provider kube-controller-manager

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2020-8559

Privilege escalation from compromised node to cluster

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

CVSS 3.1 · 6.4 Medium EPSS 6.1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2020-8558

Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.

CVSS 3.1 · 5.4 Medium EPSS 3.4% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2020-8557

Kubernetes node disk Denial of Service by writing to container /etc/hosts

The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2020-8555

Kubernetes kube-controller-manager SSRF

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).

CVSS 3.1 · 6.3 Medium EPSS 3.7% KEV · Not listed

Vendors

Fedoraproject Kubernetes Redhat

Products

Fedora Kubernetes Openshift

CVE-2020-8552

Kubernetes API server denial of service

The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.

CVSS 3.1 · 5.3 Medium EPSS 2.8% KEV · Not listed

Vendors

Fedoraproject Kubernetes Redhat

Products

Fedora Kubernetes Openshift

CVE-2020-8551

Kubernetes kubelet denial of service

The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Fedoraproject Kubernetes Redhat

Products

Fedora Kubernetes Openshift

CVE-2019-9946

kubernetes: Incorrect rule injection in CNI portmap plugin

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed

Vendors

Cncf Kubernetes Netapp and 1 more

Products

Portmap Kubernetes Cloud Insights and 2 more

CVE-2019-11254

Kubernetes API Server denial of service vulnerability from malicious YAML payloads

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

CVSS 3.1 · 6.5 Medium EPSS 3.2% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2019-11252

Credential leakage when failing to mount

The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2019-11251

kubectl cp allows symlink directory traversal

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.

CVSS 3.1 · 4.8 Medium EPSS 2.6% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2019-11250

Kubernetes client-go logs authorization headers at debug verbosity levels

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift Openshift Container Platform

CVE-2019-11249

kubectl cp allows symlink directory traversal

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.

CVSS 3.1 · 6.5 Medium EPSS 3.7% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift Openshift Container Platform

CVE-2019-11248

Kubernetes kubelet exposes /debug/pprof info on healthz port

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.

CVSS 3.1 · 8.2 High EPSS 75.1% KEV · Not listed

Vendors

Kubernetes

Products

Kubernetes

CVE-2019-11247

Kubernetes kube-apiserver allows access to custom resources via wrong scope

The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.

CVSS 3.1 · 8.1 High EPSS 2.1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift Openshift Container Platform

CVE-2019-11246

kubectl cp allows symlink directory traversal

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. Kubernetes affected versions include versions prior to 1.12.9, versions prior to 1.13.6, versions prior to 1.14.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11.

CVSS 3.1 · 6.5 Medium EPSS 3.6% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift