Summary
kubernetes
[1.12.10-1.0.10]
- [CVE-2019-16276] Kubernetes Vulnerabilities Allow Authentication Bypass, DoS
[1.12.10-1.0.9]
- Define rolling update for flannel
[1.12.10-1.0.8]
- Modify flannel/dashboard image tags to use images that have the cve fix
kubeadm-ha-setup
[0.0.2-1.0.68]
- Pull image prior to update and fix image repo for addons
[0.0.2-1.0.67]
- Bump golang build version
[0.0.2-1.0.66]
- [CVE-2019-16276] Support patching flannel/dashboard on upgrade
[0.0.2-1.0.65]
- [CVE 2019-16276] Support deploygin 1.12 and 1.13 with CVE patched
[0.0.2-1.0.64]
- [CVE-2019-16276] Support patching etcd on upgrade
[0.0.2-1.0.63]
- [CVE-2019-16276] while upgrading a cluster patch the coredns image
[0.0.2-1.0.62]
- CVE-2019-16276 : Update flannel , etcd coredns and dashboard images.
[0.0.2-1.0.61]
- Added Support for 1.13.11 and removed support for 1.13.10
[0.0.2-1.0.59]
- Remove Support for 1.14.6
[0.0.2-1.0.58]
- Replacing reference to kubernetes-dashboard-amd64 with kubernetes-dashboard
[0.0.2-1.0.57]
- Support 1.12.10
[0.0.2-1.0.56]
- Support 1.14.6
[0.0.2-1.0.55]
- Support 1.13.10
[0.0.2-1.0.54]
- Support 1.13.9
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | kubeadm | 0:1.12.10-1.0.10.el7 |
| Oracle Linux · 7 | kubeadm-ha-setup | 0:0.0.2-1.0.68.el7 |
| Oracle Linux · 7 | kubeadm-upgrade | 0:0.0.1-1.0.27.el7 |
| Oracle Linux · 7 | kubectl | 0:1.12.10-1.0.10.el7 |
| Oracle Linux · 7 | kubelet | 0:1.12.10-1.0.10.el7 |
Vulnerabilities 8
-
High 7.5
Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack
Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memo…
-
High 7.5CVE-2019-9512 EPSS 83%
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is qu…
-
Medium 6.4
kubectl cp allows symlink directory traversal
The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If…
-
Medium 5.0
Kubernetes kube-apiserver allows access to custom resources via wrong scope
The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the…
-
Medium 4.8
kubectl cp allows symlink directory traversal
The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If…
-
Medium 4.8
kubectl cp allows symlink directory traversal
The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in th…
-
Low 3.3
kubectl creates world-writeable cached schema files
In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different locati…
-
Unscored —
Request smuggling due to accepting invalid headers in net/http via net/textproto
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.