Skip to content
OpenAdvisories
High ELSA-2020-5767 2 CVEs

Important: kubernetes security update (Oracle Linux 7)

Published Jul 22, 2020 · Updated Jul 22, 2020

Ecosystem: Oracle Linux

Summary

[1.12.10-1.0.13]
- CVE-2020-8559: Privilege escalation from compromised node to cluster
- CVE-2020-8557: Node disk DOS by writing to container /etc/hosts

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 7 kubeadm 0:1.12.10-1.0.13.el7
Oracle Linux · 7 kubectl 0:1.12.10-1.0.13.el7
Oracle Linux · 7 kubelet 0:1.12.10-1.0.13.el7

Vulnerabilities 2

  • Medium 6.4
    CVE-2020-8559 Public exploit

    Privilege escalation from compromised node to cluster

    The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a ful…

    Kubernetes Kubernetes zot kots Debian Alpine Wolfi Go
  • Medium 5.5
    CVE-2020-8557

    Kubernetes node disk Denial of Service by writing to container /etc/hosts

    The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction m…

    Kubernetes Kubernetes kubernetes k8s.io/kubernetes Debian Alpine Go