PT-2018-2495 · Kubernetes+2 · Kubernetes+2

Evict · Published 2018-12-05 · Updated 2025-09-29 · CVE-2018-1002105

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kubernetes versions prior to 1.10.11 Kubernetes versions prior to 1.11.5 Kubernetes versions prior to 1.12.3

Description The issue is related to incorrect handling of error responses to proxied upgrade requests in the kube-apiserver, allowing specially crafted requests to establish a connection through the Kubernetes API server to backend servers. This enables sending arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials. The vulnerability can be exploited by a remote attacker to escalate privileges.

Recommendations For versions prior to 1.10.11, update to version 1.10.11 or later. For versions prior to 1.11.5, update to version 1.11.5 or later. For versions prior to 1.12.3, update to version 1.12.3 or later.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-388

CWE-269

Related Identifiers

ALSA-2019_3403

ALSA-2019_3494

ALSA-2025_16880

ALT-PU-2018-2805

BDU:2019-00822

CVE-2018-1002105

ELSA-2018-4303

GHSA-579H-MV94-G4GP

GO-2022-0792

OPENSUSE-SU-2020:0554-1

OPENSUSE-SU-2020_0554-1

OPENSUSE-SU-2024:10901-1

RHSA-2018:2906

RHSA-2018:2908

RHSA-2018:3537

RHSA-2018:3549

RHSA-2018:3551

RHSA-2018:3598

RHSA-2018:3624

RHSA-2018:3742

RHSA-2018:3752

RHSA-2018:3754

Affected Products

Alt Linux

Kubernetes

Suse

References · 81

• 🔥 https://github.com/evict/poc_CVE-2018-1002105 · Exploit
• 🔥 https://github.com/gravitational/cve-2018-1002105 · Exploit
• 🔥 https://github.com/imlzw/Kubernetes-1.12.3-all-auto-install · Exploit
• 🔥 https://exploit-db.com/exploits/46053 · Exploit
• 🔥 https://exploit-db.com/exploits/46052 · Exploit
• https://github.com/kubernetes/kubernetes/issues/71411 · Patch
• https://access.redhat.com/errata/RHSA-2018:3624 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0554-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3742 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1002105 · Security Note
• https://osv.dev/vulnerability/GHSA-579h-mv94-g4gp · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1002105 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3549 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3754 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3551 · Vendor Advisory