CVE-2018-1002102
CVE-2018-1002102 · Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.
CVSS 2.6 · Low · EPSS 0.6% · Fix available
- Published
- Updated
Stack: system · containers
Affected products and versions
kubernetes
- Versions
- ≥ v1.14, < v1.14.0: Affected (custom)
No fix published
kubernetes Debian:12
- Affected ranges
- ECOSYSTEM: < 1.17.4-1
Update to 1.17.4-1
kubernetes Debian:13
- Affected ranges
- ECOSYSTEM: < 1.17.4-1
Update to 1.17.4-1
kubernetes Debian:14
- Affected ranges
- ECOSYSTEM: < 1.17.4-1
Update to 1.17.4-1