Skip to content
OpenAdvisories
High ELSA-2018-4303 1 CVE

Important: kubernetes security update (Oracle Linux 7)

Published Dec 11, 2018 · Updated Dec 11, 2018

Ecosystem: Oracle Linux

Summary

[1.9.11-2.1.1]
- Fix kubeadm-registry.sh
- Use golang 1.9.3
- [CVE-2018-1002105] Handle error responses from backends
- Bump to v1.9.11

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 7 kubeadm 0:1.9.11-2.1.1.el7
Oracle Linux · 7 kubectl 0:1.9.11-2.1.1.el7
Oracle Linux · 7 kubelet 0:1.9.11-2.1.1.el7

Vulnerabilities 1

  • Critical 9.8
    CVE-2018-1002105 Public exploit EPSS 87%

    Privilege Escalation in Kubernetes

    In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backe…

    Kubernetes Kubernetes kubernetes github.com/kubernetes/kubernetes Debian Go