CVE-2018-1002102: Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints
Published Sep 26, 2018
·Updated
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.
Affected Software
6 affected componentsFixes available
redhat/atomic-openshift<0:3.11.346-1.git.0.ea10721.el7
0:3.11.346-1.git.0.ea10721.el7
redhat/kubernetes<1.14
1.14
Kubernetes kubernetes>=1.10.0<=1.13.13
Kubernetes kubernetes=1.14.0-alpha0
Kubernetes kubernetes=1.14.0-alpha1
Fedoraproject Fedora=31
Event History
Dec 3, 2019
CVE Published
12:00 AM
Dec 5, 2019
CVE Published
via MITRE·04:05 PM
Data Sourced
via MITRE·04:05 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2018-1002102.
2
What is the severity of CVE-2018-1002102?
The severity of CVE-2018-1002102 is low with a severity value of 2.6.
3
What is affected by CVE-2018-1002102?
Kubernetes API server versions prior to v1.14.0 are affected by CVE-2018-1002102.
4
How can an attacker exploit CVE-2018-1002102?
An attacker-controlled Kubelet can redirect API server requests from streaming endpoints to arbitrary hosts.
5
How can CVE-2018-1002102 be fixed?
To fix CVE-2018-1002102, update the Kubernetes API server to version 1.14.0 or higher.