Kubernetes up to 1.13.8/1.14.4/1.15.1 kube-apiserver access control

Summaryinfo

A vulnerability identified as critical has been detected in Kubernetes up to 1.13.8/1.14.4/1.15.1. Affected by this vulnerability is an unknown functionality of the component kube-apiserver. This manipulation causes access control. This vulnerability is handled as CVE-2019-11247. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Kubernetes up to 1.13.8/1.14.4/1.15.1 (Virtualization Software). Affected by this vulnerability is some unknown functionality of the component kube-apiserver. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.

The weakness was released 08/29/2019 (Website). It is possible to read the advisory at groups.google.com. This vulnerability is known as CVE-2019-11247 since 04/17/2019. The exploitation appears to be easy. The attack can be launched remotely. A single authentication is required for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 1.13.9, 1.14.5 or 1.15.2 eliminates this vulnerability.

Entry connected to this vulnerability is available at VDB-141033. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Virtualization Software

Name

• Kubernetes

Version

• 1.13.0
• 1.13.1
• 1.13.2
• 1.13.3
• 1.13.4
• 1.13.5
• 1.13.6
• 1.13.7
• 1.13.8
• 1.14.0
• 1.14.1
• 1.14.2
• 1.14.3
• 1.14.4
• 1.15.0
• 1.15.1

License

• open-source

Website

• Product: https://github.com/kubernetes/kubernetes/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion