Kubernetes API Server acts as proxy for internal and external IPs
Severity
Unspecified
Vendor
Cloud Foundry Foundation
Affected Cloud Foundry Products and Versions
- Cloud Foundry Container Runtime (CFCR)
- All versions prior to v0.26.0
Description
Kubernetes API, versions 1.11.x prior to 1.11.6, 1.12.x prior to 1.12.4, contains an improper proxy. A remote authenticated user is able to send HTTP requests through the Kubernetes API server within the server’s network.
Mitigation
Users of affected products are strongly encouraged to follow the mitigations below.
The Cloud Foundry project recommends upgrading the following releases:
- Cloud Foundry Container Runtime (CFCR)
- Upgrade to v0.26.0 or greater
References
History
2019-01-08: Initial vulnerability report published.
