low2.6
CVE-2018-1002102
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server r…
Impact
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kubernetes | Kubernetes | from 1.10.0 through 1.13.13 Version 1.14.0 |
| Fedoraproject | Fedora | Version 31 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/kubernetes/kubernetes/issues/85867
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q56CULSH7F7BC4NPS67ZS23ZCLL5TIVK/
- https://github.com/kubernetes/kubernetes/issues/85867
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q56CULSH7F7BC4NPS67ZS23ZCLL5TIVK/