CVE-2019-11244: kubectl creates world-writeable cached schema files
First published: Mon Apr 22 2019(Updated: )
In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.
Credit: jordan@liggitt.net jordan@liggitt.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/k8s.io/client-go | >=1.8.0<1.12.9 | 1.12.9 |
| Kubernetes Kubernetes | >=1.8.0<=1.14.1 | |
| Netapp Trident | ||
| Redhat Openshift Container Platform | =3.11 | |
| Redhat Openshift Container Platform | =4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2019-11244
- https://github.com/kubernetes/kubernetes/issues/76676
- https://github.com/kubernetes/kubernetes/pull/77874
- https://github.com/kubernetes/kubernetes/pull/77874/commits/f228ae3364729caed59087e23c42868454bc3ff4
- https://github.com/kubernetes/client-go/commit/790a4f63632139cf6731014d00a9a8338f1fbd7d
- https://access.redhat.com/errata/RHSA-2019:3942
- https://access.redhat.com/errata/RHSA-2020:0020
- https://access.redhat.com/errata/RHSA-2020:0074
- https://security.netapp.com/advisory/ntap-20190509-0002/
- http://www.securityfocus.com/bid/108064
- https://github.com/advisories/GHSA-2575-pghm-6qqx (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1703214
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1703211
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1703210
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1703212
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1703213
- https://access.redhat.com/security/cve/cve-2019-11244
- https://bugzilla.redhat.com/show_bug.cgi?id=1703209
Frequently Asked Questions
What is CVE-2019-11244?
CVE-2019-11244 is a vulnerability in Kubernetes v1.8.x-v1.14.x where schema info is cached with world-writeable permissions, potentially allowing unauthorized access.
How severe is CVE-2019-11244?
CVE-2019-11244 has a severity level of medium.
Which versions of Kubernetes are affected by CVE-2019-11244?
Versions 1.8.x to 1.14.x of Kubernetes are affected by CVE-2019-11244.
How can I fix CVE-2019-11244?
To fix CVE-2019-11244, update to version 1.12.9 of the go/k8s.io/client-go package or any version higher than 1.14.1 of Kubernetes.
Where can I find more information about CVE-2019-11244?
You can find more information about CVE-2019-11244 at the following references: - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-11244) - [GitHub issue](https://github.com/kubernetes/kubernetes/issues/76676) - [GitHub pull request](https://github.com/kubernetes/kubernetes/pull/77874)
- collector/github-advisory-latest
- alias/GHSA-2575-pghm-6qqx
- alias/CVE-2019-11244
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/weakness
- agent/author
- agent/type
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/severity
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- package-manager/go
- vendor/kubernetes
- canonical/kubernetes kubernetes
- version/kubernetes kubernetes/1.8.0
- version/kubernetes kubernetes/1.14.1
- vendor/netapp
- canonical/netapp trident
- vendor/redhat
- canonical/redhat openshift container platform
- version/redhat openshift container platform/3.11
- version/redhat openshift container platform/4.1