[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[oss-security] Kubernetes v1.13.9, v1.14.5, v1.15.2 released to address CVE-2019-11247, CVE-2019-11249
Hello Kubernetes Community,
We have released Kubernetes 1.13.9
to address two security issues in Kubernetes. We recommend all clusters and
kubectl clients update to one of these releases immediately.
CVE-2019-11247: API server allows access to custom resources via wrong scope
This vulnerability allows access to a cluster-scoped custom resource if the
request is made as if the resource were namespaced. Authorizations for the
resource accessed in this manner are enforced using roles and role bindings
within the namespace, meaning that a user with access only to a resource in
one namespace could create, view update or delete the cluster-scoped
resource (according to their namespace role privileges).
See Kubernetes issue #80983
<https://github.com/kubernetes/kubernetes/issues/80983> for details. Thanks
to Prabu Shyam of Verizon Media for reporting this problem.
CVE-2019-11249: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246,
kubectl cp potential directory traversal
This vulnerability allows a malicious container to cause a file to be
created or replaced on the client computer when the client uses the kubectl
cp operation. The vulnerability is a client-side defect and requires user
interaction to be exploited.
See Kubernetes issue #80984
<https://github.com/kubernetes/kubernetes/issues/80984> for details. Thanks
to Yang Yang of Amazon for reporting this problem.
As a reminder, if you find a security vulnerability in Kubernetes, please
report it following the security disclosure process
(on behalf of the Kubernetes Product Security Team)