PT-2018-15591 · Sap · Gardener

Publicado 2018-10-09 · Atualizado 2020-08-24 · CVE-2018-2475

Positive Technologies (AI Summary)

CVSS v3.1

8.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gardener versions prior to 0.12.4

Description The issue arises from missing network isolation in the Gardener architecture, allowing a shoot's apiserver to access services or endpoints in the private network of its corresponding seed cluster. When combined with other minor Kubernetes security issues, this could theoretically lead to the compromise of other shoot or seed clusters within the Gardener context. The impact of potential exploitation is considered high.

Recommendations For versions prior to 0.12.4, update to Gardener release 0.12.4 to resolve the issue. As a temporary workaround, consider restricting access to the private network of seed clusters to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2018-2475

Produtos afetados

Gardener

Referências · 6

• https://osv.dev/vulnerability/CVE-2018-2475 · Aviso do Fabricante
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095 · Aviso do Fabricante
• https://launchpad.support.sap.com/#/notes/2699726 · Aviso do Fabricante
• https://groups.google.com/forum/#%21topic/gardener/OjfKEe1LwXo · Nota
• http://securityfocus.com/bid/105579 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-2475 · Nota de Segurança