CVE-2019-11247

Name
CVE-2019-11247
Description
The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.
NVD Severity
high
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Third Party Advisory https://github.com/kubernetes/kubernetes/issues/80983
Third Party Advisory https://groups.google.com/d/msg/kubernetes-security-announce/vUtEcSEY6SM/v2ZZxsmtFQAJ
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2690
Third Party Advisory https://security.netapp.com/advisory/ntap-20190919-0003/
Third Party Advisory https://access.redhat.com/errata/RHBA-2019:2816
Third Party Advisory https://access.redhat.com/errata/RHBA-2019:2824
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2769

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* kubernetes >= 1.7.0 <= 1.12.10
cpe:2.3:a:kubernetes:kubernetes:1.12.11:beta0:*:*:*:*:*:* kubernetes == None == 1.12.11
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* kubernetes >= 1.13.0 < 1.13.9
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* kubernetes >= 1.15.0 < 1.15.2
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* kubernetes >= 1.14.0 < 1.14.5

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
k3s edge-community 0.8.0-r0 None fixed
k3s 3.22-community 0.8.0-r0 None fixed
k3s 3.21-community 0.8.0-r0 None fixed
k3s 3.20-community 0.8.0-r0 None fixed
k3s 3.19-community 0.8.0-r0 None fixed
k3s 3.18-community 0.8.0-r0 None fixed
k3s 3.17-community 0.8.0-r0 None fixed