First published: Wed Apr 24 2024(Updated: )
The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.7 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.
Affected Software | Affected Version | How to fix |
---|---|---|
go/k8s.io/kubernetes | >=0.18.0<0.18.7 | 0.18.7 |
go/k8s.io/kubernetes | >=0.17.0<0.17.9 | 0.17.9 |
go/k8s.io/kubernetes | <0.16.13 | 0.16.13 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.