CVE-2020-8555

Опубликовано: 05 июн. 2020

Источник: nvd

CVSS3: 6.3

CVSS2: 3.5

EPSS Средний

Описание

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).

Ссылки

http://www.openwall.com/lists/oss-security/2020/06/01/4
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/04/8
Mailing List
Third Party Advisory
https://github.com/kubernetes/kubernetes/issues/91542
Third Party Advisory
https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
https://security.netapp.com/advisory/ntap-20200724-0005/
Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/06/01/4
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/04/8
Mailing List
Third Party Advisory
https://github.com/kubernetes/kubernetes/issues/91542
Third Party Advisory
https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
https://security.netapp.com/advisory/ntap-20200724-0005/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*

Версия до 1.15.11 (исключая)

cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*

Версия от 1.16.0 (включая) до 1.16.9 (исключая)

cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*

Версия от 1.17.0 (включая) до 1.17.5 (исключая)

cpe:2.3:a:kubernetes:kubernetes:1.18.0:-:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.13765

Средний

6.3 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-918

Связанные уязвимости

CVE-2020-8555

CVSS3: 6.3

ubuntu

около 5 лет назад

CVE-2020-8555

CVSS3: 6.3

redhat

около 5 лет назад

CVE-2020-8555

CVSS3: 6.3

debian

около 5 лет назад

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions ...

GHSA-x6mj-w4jf-jmgw

CVSS3: 6.3

github

больше 3 лет назад

Server Side Request Forgery (SSRF) in Kubernetes

ELSA-2020-5727

oracle-oval

около 5 лет назад

ELSA-2020-5727: kubernetes-cni-plugins kubernetes-cni kubernetes olcne security update (IMPORTANT)

EPSS

Процентиль: 94%

0.13765

Средний

6.3 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-918