CVE-2018-1002105: Proxy request handling in kube-apiserver can leave vulnerable TCP connections


Share

CVE-2018-1002105: Proxy request handling in kube-apiserver can leave vulnerable TCP connections

Severity

Critical

Vendor

Kubernetes

Affected Cloud Foundry Products and Versions

  • CFCR Release
    • All versions prior to v0.25.0

Description

With a specially crafted request, users are able to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server’s TLS credentials used to establish the backend connection.

Mitigation

Users of affected versions should apply the following mitigations or upgrades:

    • CFCR release version v0.25.0

References

History

2018-12-05: Initial vulnerability report published.

Cloud Foundry Foundation Security Team Profile Image

Cloud Foundry Foundation Security Team, AUTHOR

SEE ALL ARTICLES