Information Disclosure

github.com/openshift/origin is vulnerable to information disclosure. The vulnerability is possible because kubernetes watch cache does not return the correct data in a multi tenant environment, revealing the data of a user to another user...

Man-in-the-Middle (MitM)

github.com/kubernetes/kubernetes is vulnerable to man-in-the-middle. The library uses the environment variable over DNS variable rather than the real kubernetes API URL. This allows a malicious user to conduct a MitM attacks by passing their own DNS variable to listen in...

Cross-site Scripting (XSS)

github.com/kubernetes/kubernetes is vulnerable to cross-site scripting XSS. This is because url query param from swagger-UI is not properly handled...

Denial Of Service Via Memory Leak

github.com/kubernetes/kubernetes is vulnerable to denial of service attacks via memory leak. A malicious user can cause a memory leak by creating memory backed volumes on a node that can use up all resources and crash the system...

Insecure Default Cipher

github.com/kubernetes/kubernetes is uses an insecure cipher as its default. It defaults to TLS 1.0 which is vulnerable to the POODLE attack...

Denial Of Service (DoS)

github.com/kubernetes/kubernetes is vulnerable to denial of service attacks. These attacks can be triggered by invalid JSON data. The invalid JSON data causes github.com/kubernetes/kubernetes to panic and cause a nil pointer dereference causing the master process to crash. This is related to...

PT-2017-2596 · Kubernetes · Kubernetes

Name of the Vulnerable Software and Affected Versions: Kubernetes versions 1.5.0 through 1.5.4 Description: The issue is related to a plugin for accessing PodSecurityPolicy, a software tool for managing clusters of virtual machines in Kubernetes, and is associated with insufficient access control...

3: API server does not validate client-provided intermediate certificates correctly

It was found that Kubernetes did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authentication requirements by using a specially crafted X.509 certificate...

CVE-2016-7075

It was found that Kubernetes did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authentication requirements by using a specially crafted X.509 certificate...

CVE-2016-5392

The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users with knowledge of other project names to obtain sensitive project and user information via vectors related to the watch-cache list...

CVE-2016-5392

The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users with knowledge of other project names to obtain sensitive project and user information via vectors related to the watch-cache list...

Information disclosure

The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users with knowledge of other project names to obtain sensitive project and user information via vectors related to the watch-cache list...

CVE-2016-5392

The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users with knowledge of other project names to obtain sensitive project and user information via vectors related to the watch-cache list...

CVE-2016-5392

The CVE-2016-5392 vulnerability affects Red Hat OpenShift Enterprise 3.2 deployments where the Kubernetes API server’s watch cache allows a remote, authenticated user who knows other project names to disclose sensitive project and user information. The root cause is an input validation error in t...

Google Kubernetes Information Disclosure Vulnerability

Google Kubernetes is an open source Docker container cluster management system from Google, Inc. An information disclosure vulnerability exists in Google Kubernetes, which can be exploited by attackers to obtain sensitive information...

Kubernetes: disclosure of information in multi tenant environments via watch-cache list

The Kubernetes API server contains a watch cache that speeds up performance. Due to an input validation error OpenShift Enterprise may return data for other users and projects when queried by a user. An attacker with knowledge of other project names could use this vulnerability to view their...

Important: Red Hat Security Advisory: atomic-openshift security and bug fix update

An update for atomic-openshift is now available for Red Hat OpenShift Enterprise 3.2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Analyzing Go Vendoring with BigQuery

GitHub published a snapshot of all the public open-source repositories to BigQuery and Francesc used it to draw some cool statistics about Go projects. I used the same dataset to analyze how the Go ecosystem does vendoring. Disclosure: there's some ego stroking here, as I'm the author of gvt. Try...

Modern Reverse Proxy: Traefik

Modern Reverse Proxy Træfɪk is a modern HTTP reverse proxy and load balancer made to deploy microservices with ease. It supports several backends Docker , Swarm , Mesos/Marathon , Kubernetes , Consul , Etcd , Zookeeper , BoltDB , Rest API, file… to manage its configuration automatically and...

kubernetes.io XSS vulnerability

Vulnerable URL: http://kubernetes.io/kubernetes/thirdparty/swagger-ui/?url=https://gist.githubusercontent.com/anonymous/4a5ece3c91b803536c3a81811af24225/raw/cb666406da086e666a74cf9219fcdc2e07100d9f/5742c4bee4b01190df6d640c.json Details: Description| Value ---|--- Patched:| No Latest check for...