Kubernetes: Half-Blind SSRF found in kube/cloud-controller-manager can be upgraded to complete SSRF (fully crafted HTTP requests) in vendor managed k8s service.

🗓️ 15 Jan 2020 22:33:11Reported by reeverzaxType

Half-blind SSRF vulnerability in kube/cloud-controller-manager in managed k8s service can be upgraded to complete SSRF. Investigated by two French security researchers from https://www.groupe-asten.fr/ and https://hackerone.com/reeverzax and https://hackerone.com/hach

Reporter	Title	Published	Views	Family All 79
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes controller manager security vulnerability (CVE-2020-8555)	4 Jun 202013:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Kubernetes affect IBM InfoSphere Information Server	1 Apr 202120:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	1 Sep 202514:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® Db2® On Openshift and IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data	29 Jun 202217:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Private is vulnerable to Kubernetes vulnerabilities	26 Feb 202114:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	18 Aug 202504:31	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in the Python, Docker, and ICP affect IBM Spectrum Discover	13 May 202116:56	–	ibm
IBM Security Bulletins	Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a Kubernetes controller manager security vulnerability (CVE-2020-8555)	21 Jul 202019:34	–	ibm
AlpineLinux	CVE-2020-8555	4 Jun 202021:50	–	alpinelinux
Circl	CVE-2020-8555	2 Jun 202013:13	–	circl

30 Oct 2020 21:37Current

6Medium risk

Vulners AI Score6

EPSS0.08633

$5000