This Week in Security News: Microsoft June Patch Tuesday Fixes 129 Flaws in Largest-Ever Update and New Android Spyware ActionSpy Revealed via Phishing Attacks from Earth Empusa

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about Microsoft’s largest-ever Patch Tuesday update including 129 CVEs. Also, read about a new Android Spyware dubbed ActionSpy. Read...

grafana kubernetes-cni kubernetes-cni-plugins kubernetes kubernetes olcne security update

grafana %-1.0.1 - Added Oracle Specific Build Files for grafana kubernetes-cni 0.7.1-1.0.1 - Added Oracle specific build files for Kubernetes CNI kubernetes-cni-plugins 0.8.6-1.0.1 - Added Oracle specific build files for Kubernetes CNI Plugins kubernetes 1.14.9-1.0.4 - CVE-2020-10749: IPv4 only...

kubernetes kubeadm-ha-setup kubernetes-cni kubernetes-cni-plugins security update

kubernetes 1.12.10-1.0.12 - CVE-2020-10749: IPv4 only clusters susceptible to MitM attacks via IPv6 rogue router advertisements - CVE-2020-8555: Half-Blind SSRF in kube-controller-manager kubeadm-ha-setup 0.0.2-1.0.70 - Enhance image tag read to depend on kubeadm-registry.sh for CVE release...

kubernetes-cni-plugins kubernetes-cni kubernetes olcne security update

kubernetes-cni-plugins 0.8.6-1.0.1 - Added Oracle specific build files for Kubernetes CNI Plugins kubernetes-cni 0.7.1-1.0.1 - Added Oracle specific build files for Kubernetes CNI kubernetes 1.14.9-1.0.4 - CVE-2020-10749: IPv4 only clusters susceptible to MitM attacks via IPv6 rogue router...

Kubernetes Falls to Cryptomining via Machine-Learning Framework

A unique cyberattack campaign that targets Kubeflow, a machine-learning toolkit for Kubernetes, has affected large swathes of container clusters, according to Microsoft. The Kubeflow open-source project is a popular framework for running machine-learning ML tasks in Kubernetes. According to an...

Exploit for Channel Accessible by Non-Endpoint in Linuxfoundation Cni_Network_Plugins

CVE-2020-10749 CVE-2020-10749 PoC Kubernetes MitM attacks via...

Misconfigured Kubeflow workloads are a security risk

Azure Security Center ASC monitors and defends thousands of Kubernetes clusters running on top of AKS. Azure Security Center regularly searches for and research for new attack vectors against Kubernetes workloads. We recently published a blog post about a large scale campaign against Kubernetes...

Server Side Request Forgery (SSRF)

github.com/kubernetes/kubernetes is vulnerable to Server Side Request Forgery SSRF. An attacker with a privilege to create a pod with certain built-in Volume types GlusterFS, Quobyte, StorageFS, ScaleIO or to create a StorageClass can cause an authenticated user to leak the resources from the...

CVE-2020-8555

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery SSRF that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints...

CVE-2020-8555

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery SSRF that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints...

CVE-2020-8555

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery SSRF that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints...

Server side request forgery (ssrf)

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery SSRF that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints...

UBUNTU-CVE-2020-8555

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery SSRF that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints...

Server-Side Request Forgery (SSRF)

The Kubernetes kube-controller-manager is vulnerable to a Server Side Request Forgery SSRF that allows certain authorized users to leak up to bytes of arbitrary information from unprotected endpoints within the master's host network such as link-local or loopback services...

CVE-2020-8555

CVE-2020-8555 (Kubernetes) : A SSRF in kube-controller-manager allows certain authorized users to leak up to 500 bytes from unprotected endpoints inside the master’s host network (e.g., link-local or loopback). Affected releases include Kubernetes kube-controller-manager versions v1.0–v1.14, and ...

CVE-2020-8555

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery SSRF that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints...

CVE-2020-8555 Kubernetes kube-controller-manager SSRF

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery SSRF that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints...

CVE-2020-8555

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery SSRF that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes controller manager security vulnerability (CVE-2020-8555)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in the Kubernetes controller manager that could leak data to authorized users CVE-2020-8555 Vulnerability Details CVEID: CVE-2020-8555 DESCRIPTION: There exists a Server Side Request Forgery SSRF vulnerability in...

Unspecified Vulnerability in Elastic Cloud on Kubernetes

Elasticsearch is a set of Dutch Elasticsearch company built on Lucene open source distributed RESTful search engine . The product is mainly used in cloud computing and supports data indexing via HTTP using JSON. Elastic Cloud on Kubernetes version 1.1.0 before the existence of a security...