CVE-2018-1002102

Published: Dec 5, 2019Modified: Nov 21, 2024

2.6

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

Exploitability: 1.0 / Impact: 1.4

Source: NVD

Description

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.

Affected (4)

Products: Kubernetes: Kubernetes · Fedoraproject: Fedora

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Kubernetes Kubernetes	From 1.10.0 to 1.13.13
Kubernetes Kubernetes	Version 1.14.0 alpha0
Kubernetes Kubernetes	Version 1.14.0 alpha1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 31

Related CWEs

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (4)

https://github.com/kubernetes/kubernetes/issues/85867

Source: jordan@liggitt.net

Issue TrackingMitigationThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q56CULSH7F7BC4NPS67ZS23ZCLL5TIVK/

Source: jordan@liggitt.net

https://github.com/kubernetes/kubernetes/issues/85867

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingMitigationThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q56CULSH7F7BC4NPS67ZS23ZCLL5TIVK/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.