PT-2019-11641 · Kubernetes · Kube-State-Metrics+1

Moritz S · Published 2019-11-05 · Updated 2022-05-24 · CVE-2019-10223

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: kube-state-metrics versions v1.7.0 through v1.7.1

Description: A security issue was discovered in kube-state-metrics where an experimental feature added to versions v1.7.0 and v1.7.1 enabled annotations to be exposed as metrics. By default, kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default kubectl behavior and this new feature can cause the entire secret content to end up in metric labels, thus inadvertently exposing the secret content in metrics.

Recommendations: For versions v1.7.0 and v1.7.1, upgrade to the v1.7.2 release as soon as possible. As a temporary workaround, consider disabling the experimental feature that exposes annotations as metrics until a patch is available. Restrict access to sensitive information in metric labels to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-10223

GHSA-2V6X-FRW8-7R7F

GHSA-C92W-72C5-9X59

GO-2022-0621

Affected Products

Kube-State-Metrics

Kubectl

References · 14

• 🔥 https://openwall.com/lists/oss-security/2019/08/09/1 · Exploit
• https://osv.dev/vulnerability/GHSA-2v6x-frw8-7r7f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10223 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10223 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17110 · Security Note
• https://osv.dev/vulnerability/GHSA-c92w-72c5-9x59 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10223 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0621 · Vendor Advisory
• https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2 · Note
• https://github.com/kubernetes/kube-state-metrics/commit/2a9ab3a9a0f1c4dbecb6a5577185b33bfac86a96 · Note
• https://github.com/kubernetes/kube-state-metrics · Note
• https://github.com/kubernetes/kube-state-metrics/commit/03122fe3e2df49a9a7298b8af921d3c37c430f7f · Note
• http://openwall.com/lists/oss-security/2019/08/15/8 · Note
• https://pkg.go.dev/vuln/GO-2022-0621 · Note