PROVIDSD-8966 [kubernetes-announce] [Security Advisory] CVE-2020-8561: Webhook redirect in kube-apiserver

6 views
Skip to first unread message

prov...@babiel.com

unread,
Sep 15, 2021, 5:19:02 PM9/15/21
to kubernetes-se...@googlegroups.com
—-—-—-—
Bitte antworten Sie oberhalb dieser Linie.

Guten Tag kubernetes-se...@googlegroups.com,

kubernete...@googlegroups.com hat Sie als Teilnehmer zu der Anfrage "[kubernetes-announce] [Security Advisory] CVE-2020-8561: Webhook redirect in kube-apiserver" (Ticket PROVIDSD-8966) hinzugefügt. Für weitere Details rufen Sie - wenn Sie zugriffsberechtigt sind - bitte das Kundenportal auf.

~~~~~~~~~~~~~~ Text der Anfrage ~~~~~~~~~~~~~~

Hello Kubernetes Community,

 

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

 

This issue has been rated Medium (https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) (4.1), and assigned CVE-2020-8561

Am I vulnerable?

 

You may be vulnerable if `--profiling` is enabled on the kube-apiserver and actors who control a validating or mutating webhook can access the kube-apiserver process logs.

Affected Versions

 

This issue affects all known versions of kube-apiserver. 

How do I mitigate this vulnerability?

 

This issue can be mitigated by not allowing kube-apiserver access to sensitive resources or networks, or to reduce the “v” flag value to less than 10 and set the “-profiling” flag value to “false” (default value is “true”). Setting the profiling flag to “false” prevents users from dynamically modifying the kube-apiserver log level, and the flag value Webhook requests may still be redirected to private networks with a log level less than 10, but the response body will not be logged.

Fixed Versions

 

There is no fix for this issue at this time.

Detection

 

Examining kube-apiserver log responses is the only known method of detection for this issue.

If you find evidence that this vulnerability has been exploited, please contact secu...@kubernetes.io

Additional Details

 

See the GitHub issue for more details: https://github.com/kubernetes/kubernetes/issues/104720

Acknowledgements

 

This vulnerability was reported by QiQi Xu

 

Thank You,

 

Micah Hausler on behalf of the Kubernetes Security Response Committee

 

 


You received this message because you are subscribed to the Google Groups "kubernetes-announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to kubernetes-anno...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/kubernetes-announce/C8E4A230-94C2-49D9-96C0-0CB4DE33FEA6%40amazon.com.

~~~~~~~~~~~~~~ Ende der Anfrage ~~~~~~~~~~~~~~

Aktueller Status dieses Tickets: "In Arbeit"

Bitte beachten Sie, dass diese Anfrage mit folgenden weiteren Personen geteilt wird: Newsletter, kubernete...@googlegroups.com, kubernetes-sec...@googlegroups.com, kubernetes+a...@discoursemail.com und 3 weitere Personen

Stephen Augustus

unread,
Sep 15, 2021, 5:25:10 PM9/15/21
to sysa...@babiel.com, kubernetes-se...@googlegroups.com
Please do not configure automated responses to this list.
You're sending them to everyone.

-- Stephen

--
You received this message because you are subscribed to the Google Groups "kubernetes-security-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to kubernetes-security...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/kubernetes-security-discuss/JIRA.221472.1631740675000.54278.1631740740007%40Atlassian.JIRA.
Reply all
Reply to author
Forward
0 new messages