Hello Kubernetes Community,
A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.
This issue has been rated Medium (https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) (4.1), and assigned CVE-2020-8561
Am I vulnerable?
You may be vulnerable if `--profiling` is enabled on the kube-apiserver and actors who control a validating or mutating webhook can access the kube-apiserver process logs.
This issue affects all known versions of kube-apiserver.
How do I mitigate this vulnerability?
This issue can be mitigated by not allowing kube-apiserver access to sensitive resources or networks, or to reduce the “-v” flag value to less than 10 and set the “--profiling” flag value to “false” (default value is “true”). Setting the profiling flag to “false” prevents users from dynamically modifying the kube-apiserver log level, and the flag value Webhook requests may still be redirected to private networks with a log level less than 10, but the response body will not be logged.
There is no fix for this issue at this time.
Examining kube-apiserver log responses is the only known method of detection for this issue.
If you find evidence that this vulnerability has been exploited, please contact security AT kubernetes.io
See the GitHub issue for more details: https://github.com/kubernetes/kubernetes/issues/104720
This vulnerability was reported by QiQi Xu
Micah Hausler on behalf of the Kubernetes Security Response Committee
Description: S/MIME cryptographic signature