p PatchFirst

CVE-2020-8559

CVE-2020-8559 · Privilege escalation from compromised node to cluster

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

CVSS 6.4 · Medium · EPSS 6.1% · Fix available

Published
Updated

Stack: system · containers

Affected products and versions

  • kubernetes

    Versions
    • 1.6: Affected
    • 1.7: Affected
    • 1.8: Affected
    • 1.9: Affected
    • 1.10: Affected
    • 1.11: Affected
    • 1.12: Affected
    • 1.13: Affected
    • 1.14: Affected
    • 1.15: Affected
    • ≥ 1.16, ≤ 1.16.12: Affected (custom)
    • ≥ 1.17, ≤ 1.17.8: Affected (custom)
    • ≥ 1.18, ≤ 1.18.5: Affected (custom)

    No fix published

  • kubernetes Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.18.5-1

    Update to 1.18.5-1

  • kubernetes Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.18.5-1

    Update to 1.18.5-1

  • kubernetes Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.18.5-1

    Update to 1.18.5-1

Original sources

Check your server →