In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.

An update of the kubernetes package has been released.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-4716 advisory.

  - In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir     (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-     dir is specified and pointed at a different location accessible to other users/groups, the written files     may be modified by other users/groups and disrupt the kubectl invocation. (CVE-2019-11244)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4816 advisory.

  - In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir     (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-     dir is specified and pointed at a different location accessible to other users/groups, the written files     may be modified by other users/groups and disrupt the kubectl invocation. (CVE-2019-11244)

  - Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The     attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of     responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
    (CVE-2019-9512)

  - The kubectl cp command allows copying files between containers and the user machine. To copy files from a     container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network,     and kubectl unpacks it on the user's machine. If the tar binary in the container is malicious, it could     run any code and output unexpected, malicious results. An attacker could use this to write files to any     path on the user's machine when kubectl cp is called, limited only by the system permissions of the local     user. Kubernetes affected versions include versions prior to 1.12.9, versions prior to 1.13.6, versions     prior to 1.14.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11. (CVE-2019-11246)

  - The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4     allows a combination of two symlinks provided by tar output of a malicious container to place a file     outside of the destination directory specified in the kubectl cp invocation. This could be used to allow     an attacker to place a nefarious file using a symlink, outside of the destination tree. (CVE-2019-11251)

  - The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request     is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are     enforced using roles and role bindings within the namespace, meaning that a user with access only to a     resource in one namespace could create, view update or delete the cluster-scoped resource (according to     their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions     prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12. (CVE-2019-11247)

  - The kubectl cp command allows copying files between containers and the user machine. To copy files from a     container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network,     and kubectl unpacks it on the user's machine. If the tar binary in the container is malicious, it could     run any code and output unexpected, malicious results. An attacker could use this to write files to any     path on the user's machine when kubectl cp is called, limited only by the system permissions of the local     user. Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions     prior to 1.15.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.
    (CVE-2019-11249)

  - Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling. (CVE-2019-16276)

  - Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to     v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads,     causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable.
    Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger     this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by     default for backwards compatibility. (CVE-2019-11253)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2019-4717 advisory.

  - In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir     (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-     dir is specified and pointed at a different location accessible to other users/groups, the written files     may be modified by other users/groups and disrupt the kubectl invocation. (CVE-2019-11244)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0020 advisory.

  - kubernetes: Schema info written with world-writeable permissions when cached (CVE-2019-11244)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3942 advisory.

  - kubernetes: Schema info written with world-writeable permissions when cached (CVE-2019-11244)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202867	Photon OS 2.0: Kubernetes PHSA-2019-2.0-0161	Nessus	PhotonOS Local Security Checks	medium
180728	Oracle Linux 7 : kubernetes (ELSA-2019-4716)	Nessus	Oracle Linux Local Security Checks	medium
180704	Oracle Linux 7 : kubernetes (ELSA-2019-4816)	Nessus	Oracle Linux Local Security Checks	high
180646	Oracle Linux 7 : kubeadm-ha-setup (ELSA-2019-4717)	Nessus	Oracle Linux Local Security Checks	medium
132882	RHEL 7 : OpenShift Container Platform 3.11 atomic-openshift (RHSA-2020:0020)	Nessus	Red Hat Local Security Checks	medium
131218	RHEL 7 / 8 : OpenShift Container Platform 4.1.24 openshift (RHSA-2019:3942)	Nessus	Red Hat Local Security Checks	medium
126472	Photon OS 1.0: Kubernetes PHSA-2019-1.0-0242	Nessus	PhotonOS Local Security Checks	medium
126113	Photon OS 3.0: Kubernetes PHSA-2019-3.0-0015	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2019-11244

medium

Tenable Plugins

medium

medium

high

medium

medium

medium

medium

medium