PT-2019-12209 · Kubernetes+1 · Kubernetes+1
Oleg Bulatov
·
Publicado
2019-01-18
·
Atualizado
2025-05-07
·
CVE-2019-11243
CVSS v3.1
8.1
Alta
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Kubernetes versions 1.12.0 through 1.12.4
Kubernetes version 1.13.0
Description
The issue concerns the rest.AnonymousClientConfig() method, which is supposed to return a copy of the provided config with credentials removed. However, in the affected versions, this method did not effectively clear service account credentials loaded using rest.InClusterConfig(). This means that sensitive information such as bearer tokens, usernames, passwords, and client certificate/key data was not properly removed.
Recommendations
For Kubernetes versions 1.12.0 through 1.12.4, consider updating to a version where the rest.AnonymousClientConfig() method correctly clears service account credentials.
For Kubernetes version 1.13.0, consider updating to a version where the rest.AnonymousClientConfig() method correctly clears service account credentials.
As a temporary workaround, consider restricting the use of the rest.AnonymousClientConfig() method until a patch is available.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Kubernetes