Bug 1821583 (CVE-2020-8555)
| Summary: | CVE-2020-8555 kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Sam Fowler <sfowler> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | adam.kaplan, admiller, aos-bugs, bbennett, bmontgom, chuffman, eparis, fbertina, hchiramm, hekumar, hvyas, jburrell, jcajka, jmulligan, joelsmith, jokerman, jsafrane, lhinds, madam, maszulik, mfojtik, mtleilia, nstielau, puebele, rhs-bugs, security-response-team, sfowler, sponnaga, storage-qa-internal, sttts, tsmetana, vbellur |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | kube-controller-manager 1.18.1, kube-controller-manager 1.17.5, kube-controller-manager 1.16.9, kube-controller-manager 1.15.12 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A server side request forgery (SSRF) flaw was found in Kubernetes. The kube-controller-manager allows authorized users with the ability to create StorageClasses or certain Volume types to leak up to 500 bytes of arbitrary information from the master's host network. This can include secrets from the kube-apiserver through the unauthenticated localhost port (if enabled).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-06-17 23:20:46 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1822486, 1822487, 1822488, 1822489, 1822490, 1822491, 1822492, 1822494, 1822495, 1822496, 1822497, 1825883, 1840981, 1842692, 1890053, 1890054, 1890055 | ||
| Bug Blocks: | 1821585 | ||
|
Description
Sam Fowler
2020-04-07 06:55:37 UTC
Statement: OpenShift Container Platform does not expose kube-apiserver through an unauthenticated localhost port. However, other link-local addresses are reachable without authentication that allow an attacker to access sensitive data. The version of heketi shipped with Red Hat Gluster Storage 3 includes the affected client side code for heketi and quobyte volume plugin, however the vulnerable functionality is currently not used by the product and hence this issue has been rated as having a security impact of Low. Red Hat Openshift Container Storage 4.2 is not affected by this vulnerability as rook-ceph-operator container does not include support for affected volume plugins(storageos, scaleio, glusterfs, quobyte). External References: https://groups.google.com/forum/#!topic/kubernetes-security-announce/kEK27tqqs30 Created origin tracking bugs for this issue: Affects: fedora-all [bug 1842692] Mitigation: Restrict use of the vulnerable volume type and restrict StorageClass write permissions via RBAC Upstream Issue: https://github.com/kubernetes/kubernetes/issues/91542 Upstream Patches: https://github.com/kubernetes/kubernetes/pull/89794 (master) https://github.com/kubernetes/kubernetes/pull/89796 (1.18.1+) https://github.com/kubernetes/kubernetes/pull/89837 (1.17.5+) https://github.com/kubernetes/kubernetes/pull/89838 (1.16.9+) https://github.com/kubernetes/kubernetes/pull/89839 (1.15.12+) Acknowledgments: Name: the Kubernetes Product Security Committee Upstream: Brice Augras (Groupe-Asten), Christophe Hauquiert (Nokia) This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.3 Via RHSA-2020:2440 https://access.redhat.com/errata/RHSA-2020:2440 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.3 Via RHSA-2020:2441 https://access.redhat.com/errata/RHSA-2020:2441 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.4 Via RHSA-2020:2448 https://access.redhat.com/errata/RHSA-2020:2448 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.4 Via RHSA-2020:2449 https://access.redhat.com/errata/RHSA-2020:2449 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-8555 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.11 Via RHSA-2020:2479 https://access.redhat.com/errata/RHSA-2020:2479 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.2 Via RHSA-2020:2594 https://access.redhat.com/errata/RHSA-2020:2594 |