CVE-2018-1002105 CVE-2018-1002105

漏洞描述

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.

影响产品

kuberneteskubernetes查看产品 →

修复建议

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

参考链接

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
CVE-2019-11253 Kubernetes API Server - YAML Parsing DoS (Billion Laughs) kubernetes	高危	—	—	PoCEXP	2026/01/05
kubernetes_etcd_keys Kubernetes etcd Keys Exposure kubernetes	中危	—	—	PoCEXP	2024/06/02
kubernetes_resource_report Detect Overview Kubernetes Resource Report kubernetes	中危	—	—	PoCEXP	2023/10/20
kubernetes_kustomization_disclosure Kubernetes Kustomize Configuration - Detect kubernetes	中危	5.3	—	PoCEXP	2021/07/20
CVE-2019-11248 Debug Endpoint pprof - Exposure Detection kubernetes	高危	8.2	90.8%	PoCEXP	2019/08/29

利用情报状态

漏洞描述

影响产品

修复建议

参考链接

同产品关联漏洞