/debug/pprof exposed on kubelet's healthz port

🗓️ 06 Aug 2019 14:34:33Reported by Kubernetes Security Response CommitteeType

Unsecured go pprof on kubelet healthz port; upgrade or set healthzBindAddress to 127.0.0.1.

Reporter	Title	Published	Views	Family All 35
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes security vulnerability (CVE-2019-11248)	19 Aug 201915:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Kubernetes affects IBM Watson Studio Local	20 Dec 201913:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Kubernetes affect IBM InfoSphere Information Server	1 Apr 202121:05	–	ibm
IBM Security Bulletins	Security Bulletin: A Security Vulnerability affects IBM Cloud Private Kubernetes (CVE-2019-11248)	23 Nov 201916:46	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Secuity issues fixed for NPS softlayer provisioner.	11 Dec 202007:10	–	ibm
Circl	CVE-2019-11248	18 Jul 202203:11	–	circl
CVE	CVE-2019-11248	29 Aug 201900:26	–	cve
Cvelist	CVE-2019-11248 Kubernetes kubelet exposes /debug/pprof info on healthz port	29 Aug 201900:26	–	cvelist
Debian CVE	CVE-2019-11248	29 Aug 201900:26	–	debiancve
Fedora	[SECURITY] Fedora 30 Update: kubernetes-1.15.2-1.fc30	26 Aug 201900:53	–	fedora

06 Aug 2019 14:34Current

6.7Medium risk

Vulners AI Score6.7

CVSS 26.4

CVSS 3.18.2

CVSS 36.5

EPSS0.61139