high8.1
CVE-2019-11243
Kubernetes did not effectively clear service account credentials
Impact
In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | k8s.io/kubernetes | >= 1.12.0, < 1.12.5 | 1.12.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kubernetes | Kubernetes | from 1.12.0 through 1.12.4 Version 1.13.0 |
| Netapp | Trident | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.securityfocus.com/bid/108053
- https://github.com/kubernetes/kubernetes/issues/76797
- https://security.netapp.com/advisory/ntap-20190509-0002/
- https://github.com/advisories/GHSA-gc2p-g4fg-29vh
- https://nvd.nist.gov/vuln/detail/CVE-2019-11243
- https://security.netapp.com/advisory/ntap-20190509-0002