oss-security - Kubernetes v1.13.9, v1.14.5, v1.15.2 released to address CVE-2019-11247, CVE-2019-11249

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAEftUaoQGR5-iZtSCJth9==+eN913R_hPoUTHNBJ9fmgABhO8w@mail.gmail.com>
Date: Mon, 5 Aug 2019 12:01:22 -0400
From: Joel Smith <joelsmith@...hat.com>
To: oss-security@...ts.openwall.com, 
	kubernetes-security-announce@...glegroups.com, 
	kubernetes-security-discuss@...glegroups.com
Subject: Kubernetes v1.13.9, v1.14.5, v1.15.2 released to address CVE-2019-11247, CVE-2019-11249

Hello Kubernetes Community,

We have released Kubernetes 1.13.9
<https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.13.md#v1139>,
1.14.5
<https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.14.md#v1145>,
and 1.15.2
<https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.15.md#v1152>
to address two security issues in Kubernetes. We recommend all clusters and
kubectl clients update to one of these releases immediately.

CVE-2019-11247: API server allows access to custom resources via wrong scope

This vulnerability allows access to a cluster-scoped custom resource if the
request is made as if the resource were namespaced. Authorizations for the
resource accessed in this manner are enforced using roles and role bindings
within the namespace, meaning that a user with access only to a resource in
one namespace could create, view update or delete the cluster-scoped
resource (according to their namespace role privileges).

See Kubernetes issue #80983
<https://github.com/kubernetes/kubernetes/issues/80983> for details. Thanks
to Prabu Shyam of Verizon Media for reporting this problem.

CVE-2019-11249: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246,
kubectl cp potential directory traversal

This vulnerability allows a malicious container to cause a file to be
created or replaced on the client computer when the client uses the kubectl
cp operation. The vulnerability is a client-side defect and requires user
interaction to be exploited.

See Kubernetes issue #80984
<https://github.com/kubernetes/kubernetes/issues/80984> for details. Thanks
to Yang Yang of Amazon for reporting this problem.

As a reminder, if you find a security vulnerability in Kubernetes, please
report it following the security disclosure process
<https://kubernetes.io/security/>.

Thanks,

Joel Smith

(on behalf of the Kubernetes Product Security Team)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.