PROVIDSD-8966 [kubernetes-announce] [Security Advisory] CVE-2020-8561: Webhook redirect in kube-apiserver
prov...@babiel.com
Guten Tag kubernetes-se...@googlegroups.com,
kubernete...@googlegroups.com hat Sie als Teilnehmer zu der Anfrage "[kubernetes-announce] [Security Advisory] CVE-2020-8561: Webhook redirect in kube-apiserver" (Ticket PROVIDSD-8966) hinzugefügt. Für weitere Details rufen Sie - wenn Sie zugriffsberechtigt sind - bitte das Kundenportal auf.
~~~~~~~~~~~~~~ Text der Anfrage ~~~~~~~~~~~~~~
Hello Kubernetes Community,
A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.
This issue has been rated Medium (https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) (4.1), and assigned CVE-2020-8561
Am I vulnerable?
You may be vulnerable if `--profiling` is enabled on the kube-apiserver and actors who control a validating or mutating webhook can access the kube-apiserver process logs.
Affected Versions
This issue affects all known versions of kube-apiserver.
How do I mitigate this vulnerability?
This issue can be mitigated by not allowing kube-apiserver access to sensitive resources or networks, or to reduce the “v” flag value to less than 10 and set the “-profiling” flag value to “false” (default value is “true”). Setting the profiling flag to “false” prevents users from dynamically modifying the kube-apiserver log level, and the flag value Webhook requests may still be redirected to private networks with a log level less than 10, but the response body will not be logged.
Fixed Versions
There is no fix for this issue at this time.
Detection
Examining kube-apiserver log responses is the only known method of detection for this issue.
If you find evidence that this vulnerability has been exploited, please contact secu...@kubernetes.io
Additional Details
See the GitHub issue for more details: https://github.com/kubernetes/kubernetes/issues/104720
Acknowledgements
This vulnerability was reported by QiQi Xu
Thank You,
Micah Hausler on behalf of the Kubernetes Security Response Committee
–
You received this message because you are subscribed to the Google Groups "kubernetes-announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to kubernetes-anno...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/kubernetes-announce/C8E4A230-94C2-49D9-96C0-0CB4DE33FEA6%40amazon.com.
~~~~~~~~~~~~~~ Ende der Anfrage ~~~~~~~~~~~~~~
Aktueller Status dieses Tickets: "In Arbeit"
Bitte beachten Sie, dass diese Anfrage mit folgenden weiteren Personen geteilt wird: Newsletter, kubernete...@googlegroups.com, kubernetes-sec...@googlegroups.com, kubernetes+a...@discoursemail.com und 3 weitere Personen
Stephen Augustus
--
You received this message because you are subscribed to the Google Groups "kubernetes-security-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to kubernetes-security...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/kubernetes-security-discuss/JIRA.221472.1631740675000.54278.1631740740007%40Atlassian.JIRA.