Date: Wed, 15 Sep 2021 21:21:53 +0000 From: "Hausler, Micah" <mhausler@...zon.com> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: [kubernetes] CVE-2020-8561: Webhook redirect in kube-apiserver Hello Kubernetes Community, A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs. This issue has been rated Medium (https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) (4.1), and assigned CVE-2020-8561 Am I vulnerable? You may be vulnerable if `--profiling` is enabled on the kube-apiserver and actors who control a validating or mutating webhook can access the kube-apiserver process logs. Affected Versions This issue affects all known versions of kube-apiserver. How do I mitigate this vulnerability? This issue can be mitigated by not allowing kube-apiserver access to sensitive resources or networks, or to reduce the “-v” flag value to less than 10 and set the “--profiling” flag value to “false” (default value is “true”). Setting the profiling flag to “false” prevents users from dynamically modifying the kube-apiserver log level, and the flag value Webhook requests may still be redirected to private networks with a log level less than 10, but the response body will not be logged. Fixed Versions There is no fix for this issue at this time. Detection Examining kube-apiserver log responses is the only known method of detection for this issue. If you find evidence that this vulnerability has been exploited, please contact security@...ernetes.io Additional Details See the GitHub issue for more details: https://github.com/kubernetes/kubernetes/issues/104720 Acknowledgements This vulnerability was reported by QiQi Xu Thank You, Micah Hausler on behalf of the Kubernetes Security Response Committee Content of type "text/html" skipped Download attachment "smime.p7s" of type "application/pkcs7-signature" (4700 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.