Debian Kubernetes vulnerabilities

CVE-2019-11247 [HIGH] CVE-2019-11247: kubernetes - The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custo... The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update

CVE-2019-11248 [HIGH] CVE-2019-11248: kubernetes - The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet ... The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, a

CVE-2019-11253 [HIGH] CVE-2019-11253: kubernetes - Improper input validation in the Kubernetes API server in versions v1.0-1.12 and... Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonym

CVE-2019-11254 [MEDIUM] CVE-2019-11254: kubernetes - The Kubernetes API Server component in versions 1.1-1.14, and versions prior to ... The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML. Scope: local bookworm: resolved (fixed in 1.17.4-1) bullseye: resolved (fixed in 1.17.4-1) forky: resolved (fixed in

CVE-2019-11250 [MEDIUM] CVE-2019-11250: kubernetes - The Kubernetes client-go library logs request headers at verbosity levels of 7 o... The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected. Scope: local bookworm: r

CVE-2019-1002100 [MEDIUM] CVE-2019-1002100: kubernetes - In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that ar... In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Se

CVE-2019-11252 [MEDIUM] CVE-2019-11252: kubernetes - The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a... The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes. Scope: local bookworm: resolved (fixed in 1.18.0-1) bullseye: resolved (fixed in 1.18.0-1) forky: resolved (fixed in 1.18.0-1) sid: resolved (fixed in 1.18.0-1) trixie: resolved

CVE-2019-11245 [MEDIUM] CVE-2019-11245: kubernetes - In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an expli... In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet w

CVE-2019-1002101 [MEDIUM] CVE-2019-1002101: kubernetes - The kubectl cp command allows copying files between containers and the user mach... The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attac

CVE-2019-11246 [MEDIUM] CVE-2019-11246: kubernetes - The kubectl cp command allows copying files between containers and the user mach... The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious re

CVE-2019-9946 [HIGH] CVE-2019-9946: golang-github-containernetworking-plugins - Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.... Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, th

CVE-2019-11244 [MEDIUM] CVE-2019-11244: kubernetes - In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location s... In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt

CVE-2019-11249 [MEDIUM] CVE-2019-11249: kubernetes - The kubectl cp command allows copying files between containers and the user mach... The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious re

CVE-2019-11243 [HIGH] CVE-2019-11243: kubernetes - In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() meth... In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig() Scope

CVE-2019-11251 [MEDIUM] CVE-2019-11251: kubernetes - The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.... The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symli

CVE-2018-1002105 [CRITICAL] CVE-2018-1002105: kubernetes - In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect ha... In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authent

CVE-2018-1002100 [MEDIUM] CVE-2018-1002100: kubernetes - In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, t... In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files. Scope: local bookworm: resolved (fixed in 1.17.4-1) bullseye: resolved (fixed in 1.17.4-1) forky: resolved (fixed in 1.17.4-1) sid: resolved (fixe

CVE-2018-1002102 [LOW] CVE-2018-1002102: kubernetes - Improper validation of URL redirection in the Kubernetes API server in versions ... Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet. Scope: local boo

CVE-2018-1002101 [MEDIUM] CVE-2018-1002101: kubernetes - In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input... In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2017-1000056 [CRITICAL] CVE-2017-1000056: kubernetes - Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the Po... Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object. Scope: local bookworm: resolved (fixed in 1.5.5+dfsg-1) bullseye: resolved (fixed in 1.5.5+dfsg-1) forky: resolved (fixed in 1.5.5+dfsg-1) sid: resolved (fixed in 1.