CVE-2018-1002105

🗓️ 05 Dec 2018 21:00:00Reported by kubernetesType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 607 Views

Kubernetes prior to v1.10.11, v1.11.5, and v1.12.3 allows arbitrary requests over the same connection

Reporter	Title	Published	Views	Family All 126
IBM Security Bulletins	Security Bulletin: IBM Cloud Private for Data is affected by a privilege escalation vulnerability in Kubernetes API server	3 Oct 201922:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Private is affected by a privilege escalation vulnerability in Kubernetes API server	7 Dec 201817:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Kubernetes affects IBM Watson Studio Local	20 Dec 201913:53	–	ibm
IBM Security Bulletins	Security Bulletin: A Security Vulnerability Has Been Identified In IBM Cloud Private shipped with IBM Cloud Private for Data - CVE-ID: CVE-2018-1002105	3 Oct 201922:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® Db2® On Openshift and IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data	29 Jun 202217:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect is affected by a critical privilege escalation vulnerability in Kubernetes (CVE-2018-1002105)	18 Dec 201816:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by a privilege escalation vulnerability in Kubernetes API server	6 Dec 201816:25	–	ibm
IBM Security Bulletins	Security Bulletin: A Security Vulnerability Has Been Identified In IBM Cloud Private shipped with IBM Event Streams CVE-ID: CVE-2018-1002105	7 Dec 201817:00	–	ibm
0day.today	Kubernetes - (Authenticated) Arbitrary Requests Exploit	24 Dec 201800:00	–	zdt
0day.today	Kubernetes - (Unauthenticated) Arbitrary Requests Exploit	24 Dec 201800:00	–	zdt

NVD

Node

kubernetes kubernetesRange1.0.0–1.9.11

kubernetes kubernetesRange1.10.0–1.10.10

kubernetes kubernetesRange1.11.0–1.11.4

kubernetes kubernetesRange1.12.0–1.12.2

kubernetes kubernetesMatch1.9.12beta0

Node

redhat openshift_container_platformMatch3.2

redhat openshift_container_platformMatch3.3

redhat openshift_container_platformMatch3.4

redhat openshift_container_platformMatch3.5

redhat openshift_container_platformMatch3.6

redhat openshift_container_platformMatch3.8

redhat openshift_container_platformMatch3.10

redhat openshift_container_platformMatch3.11

Node

netapp tridentMatch-

[
  {
    "product": "Kubernetes",
    "vendor": "Kubernetes",
    "versions": [
      {
        "status": "affected",
        "version": "v1.0.x"
      },
      {
        "status": "affected",
        "version": "v1.1.x"
      },
      {
        "status": "affected",
        "version": "v1.2.x"
      },
      {
        "status": "affected",
        "version": "v1.3.x"
      },
      {
        "status": "affected",
        "version": "v1.4.x"
      },
      {
        "status": "affected",
        "version": "v1.5.x"
      },
      {
        "status": "affected",
        "version": "v1.6.x"
      },
      {
        "status": "affected",
        "version": "v1.7.x"
      },
      {
        "status": "affected",
        "version": "v1.8.x"
      },
      {
        "status": "affected",
        "version": "v1.9.x"
      },
      {
        "lessThan": "v1.10.11",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "v1.11.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "v1.12.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
security	www.security.netapp.com/advisory/ntap-20190416-0001/
github	www.github.com/kubernetes/kubernetes/issues/71411
access	www.access.redhat.com/errata/RHSA-2018:3742
exploit-db	www.exploit-db.com/exploits/46052/
access	www.access.redhat.com/errata/RHSA-2018:3537
access	www.access.redhat.com/errata/RHSA-2018:3549
openwall	www.openwall.com/lists/oss-security/2019/06/28/2
lists	www.lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
coalfire	www.coalfire.com/The-Coalfire-Blog/December-2018/Kubernetes-Vulnerability-What-You-Can-Should-Do
groups	www.groups.google.com/forum/

21 Nov 2024 03:40Current

7.4High risk

Vulners AI Score7.4

CVSS 27.5

CVSS 39.8

EPSS0.90104

CWE-388