Kubernetes API Server acts as proxy for internal and external IPs

Severity

Unspecified

Vendor

Cloud Foundry Foundation

Affected Cloud Foundry Products and Versions

• Cloud Foundry Container Runtime (CFCR)
  • All versions prior to v0.26.0

Description

Kubernetes API, versions 1.11.x prior to 1.11.6, 1.12.x prior to 1.12.4, contains an improper proxy. A remote authenticated user is able to send HTTP requests through the Kubernetes API server within the server’s network.

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below.

The Cloud Foundry project recommends upgrading the following releases:

• Cloud Foundry Container Runtime (CFCR)
  • Upgrade to v0.26.0 or greater

References

• https://github.com/kubernetes/kubernetes/pull/71980

History

2019-01-08: Initial vulnerability report published.