Auth bypass in Kubernetes
CVE-2019-11247
The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.021 (80.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 81st percentile — 80.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.021 · newest: 0.021 · change: 0.000
Affected products
- Kubernetes — versions 1.10, 1.7, prior to 1.14.5
- Red Hat Openshift Container Platform — versions 3.9, 3.10, 3.11
Weakness classification (CWE)
Public proof-of-concept exploits
- ARPSyndicate/cvemon
- adavarski/HomeLab-Proxmox-k8s-DevSecOps-playground
- adavarski/HomeLab-k8s-DevSecOps-playground
- atwilsecurity/k8s-Security
- cloudnative-security/hacking-kubernetes
- dli408097/k8s-security
- g3rzi/HackingKubernetes
- hacking-kubernetes/hacking-kubernetes.info
- magnologan/awesome-k8s-security
- rosyrut/K8S-Security
References
- github.com/kubernetes/kubernetes/issues/80983 (Third Party Advisory)
- groups.google.com/d/msg/kubernetes-security-announce/vUtEcSEY6SM/v2ZZxsmtFQAJ (mailing-list, Third Party Advisory)
- access.redhat.com/errata/RHSA-2019:2690 (vendor-advisory, Third Party Advisory)
- security.netapp.com/advisory/ntap-20190919-0003/ (Third Party Advisory)
- access.redhat.com/errata/RHBA-2019:2816 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHBA-2019:2824 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2019:2769 (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-11247?
- CVE-2019-11247 is a high-severity vulnerability in Kubernetes, classified under Improper Input Validation. CVSS score: 8.1/10. Published 2019-08-29.
- How severe is CVE-2019-11247?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2019-11247 known to be exploited?
- 12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.