Date: Mon, 5 Aug 2019 12:01:22 -0400 From: Joel Smith <joelsmith@...hat.com> To: oss-security@...ts.openwall.com, kubernetes-security-announce@...glegroups.com, kubernetes-security-discuss@...glegroups.com Subject: Kubernetes v1.13.9, v1.14.5, v1.15.2 released to address CVE-2019-11247, CVE-2019-11249 Hello Kubernetes Community, We have released Kubernetes 1.13.9 <https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1139>, 1.14.5 <https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1145>, and 1.15.2 <https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.15.md#v1152> to address two security issues in Kubernetes. We recommend all clusters and kubectl clients update to one of these releases immediately. CVE-2019-11247: API server allows access to custom resources via wrong scope This vulnerability allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). See Kubernetes issue #80983 <https://github.com/kubernetes/kubernetes/issues/80983> for details. Thanks to Prabu Shyam of Verizon Media for reporting this problem. CVE-2019-11249: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal This vulnerability allows a malicious container to cause a file to be created or replaced on the client computer when the client uses the kubectl cp operation. The vulnerability is a client-side defect and requires user interaction to be exploited. See Kubernetes issue #80984 <https://github.com/kubernetes/kubernetes/issues/80984> for details. Thanks to Yang Yang of Amazon for reporting this problem. As a reminder, if you find a security vulnerability in Kubernetes, please report it following the security disclosure process <https://kubernetes.io/security/>. Thanks, Joel Smith (on behalf of the Kubernetes Product Security Team)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.