Fluid Attacks Database

Description

Privilege Escalation in Kubernetes The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.7 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
go	k8s.io/apimachinery	>=0 <0.16.13 \|\| >=0.17.0 <0.17.9 \|\| >=0.18.0 <0.18.7	0.16.13, 0.17.9, 0.18.7
go	k8s.io/kubernetes	>=0 <1.16.13 \|\| >=1.17.0 <1.17.9 \|\| >=1.18.0 <1.18.7	1.16.13, 1.17.9, 1.18.7
go	github.com/kubernetes/apimachinery	>=1.7.6 <=1.16.13 \|\| >=1.17.0 <1.17.9 \|\| >=1.18.0 <1.18.6	0.19.0-rc.1
debian 11	kubernetes	>=0 <1.18.5-1	1.18.5-1
debian 12	kubernetes	>=0 <1.18.5-1	1.18.5-1
debian 14	kubernetes	>=0 <1.18.5-1	1.18.5-1
go	github.com/kubernetes/kubernetes	>=1.6.0 <=1.16.13 \|\| >=1.17.0 <1.17.9 \|\| >=1.18.0 <1.18.6	v1.18.6, v1.17.9
go	k8s.io/kubernetes/pkg/apis/apps/validation	>=1.6.0 <1.16.13 \|\| >=1.17.0 <1.17.9 \|\| >=1.18.0 <1.18.6	1.16.13, 1.17.9, 1.18.6
debian 13	kubernetes	>=0 <1.18.5-1	1.18.5-1

Aliases

1. CVE-2020-85592. NVD-2020-85593. OSV-2020-85594. OSV-DEBIAN-2020-85595. GCVE-2020-85596. SECURITY-TRACKER-CVE-2020-8559

References

1. https://github.com/kubernetes/kubernetes/issues/929142. https://github.com/kubernetes/kubernetes/pull/929413. https://bugzilla.redhat.com/show_bug.cgi?id=18514224. https://github.com/tdwyer/CVE-2020-85595. https://groups.google.com/d/msg/kubernetes-security-announce/JAIGG5yNROs/19nHQ5wkBwAJ6. https://groups.google.com/g/kubernetes-security-announce/c/JAIGG5yNROs7. https://security.netapp.com/advisory/ntap-20200810-00048. https://github.com/tabbysable/POC-2020-8559

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.