PT-2017-11019 · Microsoft · Kubernetes Azure Cloud Provider

Brandon Philips · Publicado 2017-09-14 · Atualizado 2017-09-29 · CVE-2017-1002100

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kubernetes Azure cloud provider versions 1.6.0 through 1.6.5

Description The issue concerns the default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider. These permissions are set to "container", which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the Kubernetes cluster or authenticated access to the Azure portal.

Recommendations For versions 1.6.0 through 1.6.5, consider restricting access to the exposed URI to prevent unauthorized access until a fix is available. As a temporary workaround, limit privileged access to the Kubernetes cluster and authenticated access to the Azure portal to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-1002100

Produtos afetados

Kubernetes Azure Cloud Provider

Referências · 4

• https://github.com/kubernetes/kubernetes/issues/47611 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2017-1002100 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-1002100 · Aviso do Fabricante
• https://groups.google.com/d/msg/kubernetes-security-announce/n3VBg_WJZic/-ddIqKXqAAAJ · Correção