CVE-2019-11248: Kubernetes kubelet exposes /debug/pprof info on healthz port
First published: Thu Aug 29 2019(Updated: )
The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
Credit: jordan@liggitt.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Kubernetes Kubernetes | <1.12.10 | |
| Kubernetes Kubernetes | =1.13.0 | |
| Kubernetes Kubernetes | =1.13.0-alpha0 | |
| Kubernetes Kubernetes | =1.13.0-alpha1 | |
| Kubernetes Kubernetes | =1.13.0-alpha2 | |
| Kubernetes Kubernetes | =1.13.0-alpha3 | |
| Kubernetes Kubernetes | =1.13.0-beta0 | |
| Kubernetes Kubernetes | =1.13.0-beta1 | |
| Kubernetes Kubernetes | =1.13.0-beta2 | |
| Kubernetes Kubernetes | =1.13.0-rc1 | |
| Kubernetes Kubernetes | =1.13.0-rc2 | |
| Kubernetes Kubernetes | =1.13.1 | |
| Kubernetes Kubernetes | =1.13.1-beta0 | |
| Kubernetes Kubernetes | =1.13.2 | |
| Kubernetes Kubernetes | =1.13.2-beta0 | |
| Kubernetes Kubernetes | =1.13.3 | |
| Kubernetes Kubernetes | =1.13.3-beta0 | |
| Kubernetes Kubernetes | =1.13.4 | |
| Kubernetes Kubernetes | =1.13.4-beta0 | |
| Kubernetes Kubernetes | =1.13.5 | |
| Kubernetes Kubernetes | =1.13.5-beta0 | |
| Kubernetes Kubernetes | =1.13.6 | |
| Kubernetes Kubernetes | =1.13.6-beta0 | |
| Kubernetes Kubernetes | =1.13.7 | |
| Kubernetes Kubernetes | =1.13.7-beta.0 | |
| Kubernetes Kubernetes | =1.13.8-beta.0 | |
| Kubernetes Kubernetes | =1.14.0 | |
| Kubernetes Kubernetes | =1.14.0-alpha0 | |
| Kubernetes Kubernetes | =1.14.0-alpha1 | |
| Kubernetes Kubernetes | =1.14.0-alpha2 | |
| Kubernetes Kubernetes | =1.14.0-alpha3 | |
| Kubernetes Kubernetes | =1.14.0-beta0 | |
| Kubernetes Kubernetes | =1.14.0-beta1 | |
| Kubernetes Kubernetes | =1.14.0-beta2 | |
| Kubernetes Kubernetes | =1.14.0-rc1 | |
| Kubernetes Kubernetes | =1.14.1 | |
| Kubernetes Kubernetes | =1.14.1-beta0 | |
| Kubernetes Kubernetes | =1.14.2 | |
| Kubernetes Kubernetes | =1.14.2-beta0 | |
| Kubernetes Kubernetes | =1.14.3 | |
| Kubernetes Kubernetes | =1.14.3-beta0 | |
| Kubernetes Kubernetes | =1.14.4-beta.0 | |
| Kubernetes Kubernetes | =1.15.0-alpha0 | |
| Kubernetes Kubernetes | =1.15.0-alpha1 | |
| Kubernetes Kubernetes | =1.15.0-alpha2 | |
| Kubernetes Kubernetes | =1.15.0-alpha3 | |
| Kubernetes Kubernetes | =1.15.0-beta0 | |
| Kubernetes Kubernetes | =1.15.0-beta1 | |
| Kubernetes Kubernetes | =1.15.0-beta2 | |
| Kubernetes Kubernetes | =1.15.0-rc1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-11248?
CVE-2019-11248 is a vulnerability in Kubernetes where the debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port, potentially leaking sensitive information.
What is the severity of CVE-2019-11248?
CVE-2019-11248 has a severity score of 8.2, which is considered high.
Can this vulnerability affect Kubernetes versions 1.14.2 and below?
No, this vulnerability only affects Kubernetes versions 1.14.3 and above.
How can I fix CVE-2019-11248?
To fix CVE-2019-11248, you should upgrade your Kubernetes cluster to version 1.14.3 or above.
Where can I find more information about CVE-2019-11248?
You can find more information about CVE-2019-11248 on the Kubernetes GitHub page and the Kubernetes Security Announce group.
- collector/nvd-index
- agent/type
- agent/weakness
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/title
- agent/author
- agent/remedy
- agent/severity
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/kubernetes
- canonical/kubernetes kubernetes
- version/kubernetes kubernetes/1.13.0
- version/kubernetes kubernetes/1.13.0-alpha0
- version/kubernetes kubernetes/1.13.0-alpha1
- version/kubernetes kubernetes/1.13.0-alpha2
- version/kubernetes kubernetes/1.13.0-alpha3
- version/kubernetes kubernetes/1.13.0-beta0
- version/kubernetes kubernetes/1.13.0-beta1
- version/kubernetes kubernetes/1.13.0-beta2
- version/kubernetes kubernetes/1.13.0-rc1
- version/kubernetes kubernetes/1.13.0-rc2
- version/kubernetes kubernetes/1.13.1
- version/kubernetes kubernetes/1.13.1-beta0
- version/kubernetes kubernetes/1.13.2
- version/kubernetes kubernetes/1.13.2-beta0
- version/kubernetes kubernetes/1.13.3
- version/kubernetes kubernetes/1.13.3-beta0
- version/kubernetes kubernetes/1.13.4
- version/kubernetes kubernetes/1.13.4-beta0
- version/kubernetes kubernetes/1.13.5
- version/kubernetes kubernetes/1.13.5-beta0
- version/kubernetes kubernetes/1.13.6
- version/kubernetes kubernetes/1.13.6-beta0
- version/kubernetes kubernetes/1.13.7
- version/kubernetes kubernetes/1.13.7-beta.0
- version/kubernetes kubernetes/1.13.8-beta.0
- version/kubernetes kubernetes/1.14.0
- version/kubernetes kubernetes/1.14.0-alpha0
- version/kubernetes kubernetes/1.14.0-alpha1
- version/kubernetes kubernetes/1.14.0-alpha2
- version/kubernetes kubernetes/1.14.0-alpha3
- version/kubernetes kubernetes/1.14.0-beta0
- version/kubernetes kubernetes/1.14.0-beta1
- version/kubernetes kubernetes/1.14.0-beta2
- version/kubernetes kubernetes/1.14.0-rc1
- version/kubernetes kubernetes/1.14.1
- version/kubernetes kubernetes/1.14.1-beta0
- version/kubernetes kubernetes/1.14.2
- version/kubernetes kubernetes/1.14.2-beta0
- version/kubernetes kubernetes/1.14.3
- version/kubernetes kubernetes/1.14.3-beta0
- version/kubernetes kubernetes/1.14.4-beta.0
- version/kubernetes kubernetes/1.15.0-alpha0
- version/kubernetes kubernetes/1.15.0-alpha1
- version/kubernetes kubernetes/1.15.0-alpha2
- version/kubernetes kubernetes/1.15.0-alpha3
- version/kubernetes kubernetes/1.15.0-beta0
- version/kubernetes kubernetes/1.15.0-beta1
- version/kubernetes kubernetes/1.15.0-beta2
- version/kubernetes kubernetes/1.15.0-rc1