PT-2019-12209 · Kubernetes+1 · Kubernetes+1

Oleg Bulatov · Published 2019-01-18 · Updated 2025-05-07 · CVE-2019-11243

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kubernetes versions 1.12.0 through 1.12.4 Kubernetes version 1.13.0

Description The issue concerns the rest.AnonymousClientConfig() method, which is supposed to return a copy of the provided config with credentials removed. However, in the affected versions, this method did not effectively clear service account credentials loaded using rest.InClusterConfig(). This means that sensitive information such as bearer tokens, usernames, passwords, and client certificate/key data was not properly removed.

Recommendations For Kubernetes versions 1.12.0 through 1.12.4, consider updating to a version where the rest.AnonymousClientConfig() method correctly clears service account credentials. For Kubernetes version 1.13.0, consider updating to a version where the rest.AnonymousClientConfig() method correctly clears service account credentials. As a temporary workaround, consider restricting the use of the rest.AnonymousClientConfig() method until a patch is available.

Fix

Weakness Enumeration

CWE-212

CWE-271

Related Identifiers

ALT-PU-2019-1074

CVE-2019-11243

GHSA-GC2P-G4FG-29VH

GO-2025-3645

OPENSUSE-SU-2025:15059-1

Affected Products

Alt Linux

Kubernetes

References · 23

• https://nvd.nist.gov/vuln/detail/CVE-2019-11243 · Security Note
• https://osv.dev/vulnerability/GHSA-gc2p-g4fg-29vh · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3645 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15059-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11243 · Vendor Advisory
• https://github.com/kubernetes/kubernetes · Note
• https://github.com/kubernetes/kubernetes/issues/76797 · Note
• https://github.com/advisories/GHSA-gc2p-g4fg-29vh · Note
• https://suse.com/security/cve/CVE-2025-4210 · Note
• https://suse.com/security/cve/CVE-2025-23390 · Note
• https://security.netapp.com/advisory/ntap-20190509-0002 · Note
• http://securityfocus.com/bid/108053 · Note
• https://suse.com/security/cve/CVE-2025-3879 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/HNV7O7SNYYY4AFS5HKAPLITKK3B57LE7 · Note
• https://suse.com/security/cve/CVE-2025-46327 · Note