v1.13.9, v1.14.5, v1.15.2 released to address CVE-2019-11247, CVE-2019-11249

[Joel Smith]

Hello Kubernetes Community,

We have released Kubernetes 1.13.9, 1.14.5, and 1.15.2 to address two security issues in Kubernetes. We recommend all clusters and kubectl clients update to one of these releases immediately.

CVE-2019-11247: API server allows access to custom resources via wrong scope

This vulnerability allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges).

See Kubernetes issue #80983 for details. Thanks to Prabu Shyam of Verizon Media for reporting this problem.

CVE-2019-11249: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal

This vulnerability allows a malicious container to cause a file to be created or replaced on the client computer when the client uses the kubectl cp operation. The vulnerability is a client-side defect and requires user interaction to be exploited.

See Kubernetes issue #80984 for details. Thanks to Yang Yang of Amazon for reporting this problem.

As a reminder, if you find a security vulnerability in Kubernetes, please report it following the security disclosure process.

Thanks,

Joel Smith

(on behalf of the Kubernetes Product Security Team)