SUSE-RU-2020:2204-1 Bugfixes on cilium, gangway and skuba and security fix for Kubernetes (cve-2020-8557)

= Required Actions == Kubernetes Security fix This fix will be applied to the kubelet daemon running on the nodes by skuba-update. See https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/clusterupdates.htmlbaseosupdates for more details. Make sure you look at the Release Notes...

CVE-2018-1002104

Versions 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly...

CVE-2019-11243

In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig method returns a copy of the provided config, with credentials removed bearer token, username/password, and client certificate/key data. In the affected versions, rest.AnonymousClientConfig did not effectively clear service...

Default credentials

Versions 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly...

Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes security vulnerability (CVE-2019-11247)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in Kubernetes API server that allows access to custom resources via wrong scope CVE-2019-11247 Vulnerability Details CVE-ID: CVE-2019-11247 Description: Kubernetes could allow a remote authenticated attacker to gain...

CVE-2019-11243

Kubernetes CVE-2019-11243 affects v1.12.0–v1.12.4 and v1.13.0, where rest.AnonymousClientConfig() copies the config without clearing service account credentials loaded via rest.InClusterConfig(), potentially exposing credentials. Upgrade to a fixed version per vendor advisories.

CVE-2015-7528

Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name...

CVE-2015-7528

CVE-2015-7528 affects Kubernetes prior to 1.2.0-alpha.5, where the API/back end could be leveraged to read arbitrary pod logs by specifying a container name. The root cause is insufficient verification of log-location requests, enabling a remote attacker to access pod logs that should be restrict...