Original description
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.
Affected software
- Kubernetes = 1.14.0≥ 1.10.0 ≤ 1.13.13 exact match
Details
- Published
- 2019-12-06
- Last modified
- 2024-09-17
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N- CWE
- CWE-601
References
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
This product uses data from the NVD API but is not endorsed or certified by the NVD. CVE® is a registered trademark of The MITRE Corporation; CVE records are used under the CVE Program Terms of Use.