SB2019120529 - Open redirect in Kubernetes
Published: December 5, 2019 Updated: August 8, 2020
Security Bulletin ID
SB2019120529
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Open redirect (CVE-ID: CVE-2018-1002102)
The vulnerability allows a remote privileged user to gain access to sensitive information.
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.
Remediation
Install update from vendor's website.