CVE-2020-8559
MEDIUM6.8EPSS 51.2%Privilege Escalation in Kubernetes
發布日:2024/4/24修改日:2026/2/4
描述
The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.7 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.
受影響套件(5)
- Debian/kubernetesfrom 0, < 1.18.5-1
- Go/k8s.io/apimachineryfrom 0, < 0.16.13
- Go/k8s.io/apimachineryfrom 0, < 0.16.13, >= 0.17.0, < 0.17.9, >= 0.18.0, < 0.18.7-rc.0
- Go/k8s.io/kubernetesfrom 0, < 1.16.13
- Go/k8s.io/kubernetesfrom 0, < 1.16.13, >= 1.17.0, < 1.17.9, >= 1.18.0, < 1.18.7
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
參考連結(11)
- ADVISORYhttps://github.com/advisories/GHSA-33c5-9fx5-fvjm
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-8559
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2020-8559
- PATCHhttps://github.com/kubernetes/kubernetes
- WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=1851422
- WEBhttps://github.com/kubernetes/kubernetes/issues/92914
- WEBhttps://github.com/kubernetes/kubernetes/pull/92941
- WEBhttps://github.com/tdwyer/CVE-2020-8559
- WEBhttps://groups.google.com/d/msg/kubernetes-security-announce/JAIGG5yNROs/19nHQ5wkBwAJ
- WEBhttps://groups.google.com/g/kubernetes-security-announce/c/JAIGG5yNROs
- WEBhttps://security.netapp.com/advisory/ntap-20200810-0004