REDHAT-BUG-1703209: Low severity kubernetes dashboard vulnerability
In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.
Upstream issue:
https://github.com/kubernetes/kubernetes/issues/76676
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1703209?
The severity of REDHAT-BUG-1703209 is considered high due to the exposure of cached schema information with world-writeable permissions.
How do I fix REDHAT-BUG-1703209?
To fix REDHAT-BUG-1703209, ensure that the --cache-dir directory has restricted permissions and is not writable by unauthorized users.
Which versions of Kubernetes are affected by REDHAT-BUG-1703209?
Kubernetes versions v1.8.x to v1.14.x are affected by REDHAT-BUG-1703209.
What files are impacted by REDHAT-BUG-1703209?
The schema info cached by kubectl in the specified --cache-dir is impacted by REDHAT-BUG-1703209.
What does REDHAT-BUG-1703209 mean for multi-user environments?
In multi-user environments, REDHAT-BUG-1703209 could lead to unauthorized access to sensitive configuration data stored in the cache.