CVSS: 6.8EPSS: 58%CPEs: 4EXPL: 4CVE-2020-8559 – Privilege escalation from compromised node to cluster
https://notcve.org/view.php?id=CVE-2020-8559
22 Jul 2020 — The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise. El Kubernetes kube-apiserver en versiones v1.6-v1.15 y versiones anteriores a v1.16.13, v1.17.9 y v1.18.6, son vulnerables a un redireccionamiento no validado en las peticiones de actualización proxy que podrían permitir a un ataca... • https://github.com/tdwyer/CVE-2020-8559 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.8EPSS: 25%CPEs: 3EXPL: 4CVE-2020-8558 – Kubernetes node setting allows for neighboring hosts to bypass localhost boundary
https://notcve.org/view.php?id=CVE-2020-8558
13 Jul 2020 — The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service. Se... • https://github.com/tabbysable/POC-2020-8558 • CWE-300: Channel Accessible by Non-Endpoint CWE-420: Unprotected Alternate Channel •
CVSS: 6.3EPSS: 16%CPEs: 5EXPL: 0CVE-2020-8555 – Kubernetes kube-controller-manager SSRF
https://notcve.org/view.php?id=CVE-2020-8555
04 Jun 2020 — The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services). El Kubernetes kube-controller-manager en las versiones v1.0-1.14, versiones anteriores a v1.15.12, v1.16.9, v1.17.5 y v1.18.0, son vulnerabl... • http://www.openwall.com/lists/oss-security/2020/06/01/4 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-11254 – Kubernetes API Server denial of service vulnerability from malicious YAML payloads
https://notcve.org/view.php?id=CVE-2019-11254
01 Apr 2020 — The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML. El componente Kubernetes API Server en versiones 1.1-1.14 y versiones anteriores a 1.15.10, 1.16.7 y 1.17.3, permite a un usuario autorizado que envía cargas maliciosas de YAML causar que el kube-apiserver consuma ciclos de CPU excesivos mientras analiza YAML. Red ... • https://github.com/kubernetes/kubernetes/issues/89535 • CWE-400: Uncontrolled Resource Consumption CWE-1050: Excessive Platform Resource Consumption within a Loop •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-8552 – Kubernetes API server denial of service
https://notcve.org/view.php?id=CVE-2020-8552
27 Mar 2020 — The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests. Se detectó que el componente servidor de la API Kubernetes en versiones anteriores a 1.15.9, versiones 1.16.0-1.16.6 y versiones 1.17.0-1.17.2, es vulnerable a un ataque de denegación de servicio versiones por medio de unas peticiones de la API con éxito. A denial of service vulnerability was found in the Kubernetes API s... • https://github.com/kubernetes/kubernetes/issues/89378 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling CWE-789: Memory Allocation with Excessive Size Value •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-8551 – Kubernetes kubelet denial of service
https://notcve.org/view.php?id=CVE-2020-8551
27 Mar 2020 — The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250. Se detectó que el componente Kubelet en versiones 1.15.0-1.15.9, versiones 1.16.0-1.16.6 y versiones 1.17.0-1.17.2, es vulnerable a un ataque de denegación de servicio por medio la API de kubelet, inclu... • https://github.com/kubernetes/kubernetes/issues/89377 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling CWE-789: Memory Allocation with Excessive Size Value •
CVSS: 7.5EPSS: 39%CPEs: 8EXPL: 1CVE-2019-11253 – Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack
https://notcve.org/view.php?id=CVE-2019-11253
16 Oct 2019 — Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive poli... • https://access.redhat.com/errata/RHSA-2019:3239 • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') •
CVSS: 6.5EPSS: 0%CPEs: 10EXPL: 0CVE-2019-11250 – Kubernetes client-go logs authorization headers at debug verbosity levels
https://notcve.org/view.php?id=CVE-2019-11250
29 Aug 2019 — The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected. La biblioteca de servicio de cliente de Kubernetes registra los encabezados de solicitud en niveles de detalle de 7 o superior. Esto puede revelar las credenciales a los usu... • http://www.openwall.com/lists/oss-security/2020/10/16/2 • CWE-532: Insertion of Sensitive Information into Log File •