CVE-2020-8555: Kubernetes kube-controller-manager SSRF
A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master's host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).
Other sources
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
There exists a Server Side Request Forgery (SSRF) vulnerability in kube-controller-manager that allows certain authorized users to leak up to 500 bytes of arbitrary information from the master's host network, including secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).
An attacker with permissions to create a pod with certain built-in Volume types (GlusterFS, Quobyte, StorageFS, ScaleIO) or permissions to create a StorageClass can cause kube-controller-manager to make GET requests or POST requests without an attacker controlled request body from the master's host network.
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-8555?
CVE-2020-8555 is a vulnerability in the Kubernetes kube-controller-manager that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints.
What is the severity of CVE-2020-8555?
The severity of CVE-2020-8555 is medium, with a CVSS score of 6.3.
How can I fix CVE-2020-8555?
To fix CVE-2020-8555, you need to upgrade to Kubernetes versions 1.15.12, 1.16.9, 1.17.5, or 1.18.1, depending on the affected version.
Where can I find more information about CVE-2020-8555?
You can find more information about CVE-2020-8555 at the following references: [CVE-2020-8555](https://www.cve.org/CVERecord?id=CVE-2020-8555), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-8555), [Kubernetes Security Announce](https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30), [Bugzilla Red Hat](https://bugzilla.redhat.com/show_bug.cgi?id=1821583), [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2020:2479).
What is the Common Weakness Enumeration (CWE) of CVE-2020-8555?
The CWEs associated with CVE-2020-8555 are CWE-918 (Server-Side Request Forgery) and CWE-200 (Information Exposure).