Description (CNA)
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Kubernetes / Kubernetes | affected v1.14 before v1.14.0 |
CWE
CWE-601
References
- https://github.com/kubernetes/kubernetes/issues/85867
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q56CULSH7F7BC4NPS67ZS23ZCLL5TIVK/
ADP enrichment
No English description supplied.