medium5.3
CVE-2018-1002104
Kubernetes ingress exposes sensitive information
Impact
Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | k8s.io/ingress-nginx | < 1.5 | 1.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kubernetes | Nginx Ingress Controller | before 1.5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/kubernetes/ingress-nginx/pull/3125
- https://github.com/advisories/GHSA-p3x5-5xpx-9phm
- https://nvd.nist.gov/vuln/detail/CVE-2018-1002104
- https://github.com/kubernetes/ingress-nginx/issues/1733
- https://github.com/kubernetes/ingress-nginx/commit/d487a50e399100ad8db12ed1d2f92271f311f676