Server-side request forgery (SSRF) In k8s.io/kubernetes
Description
Server Side Request Forgery (SSRF) in Kubernetes The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 go | 1.18.1, 1.18.1, 1.16.9, 1.15.12, 1.15.12 | ||
 debian 12 | 1.18.2-1 | ||
debian 11 | 1.18.2-1 | ||
go | 1.18.1, 1.17.4, 1.16.9, 1.15.12 | ||
go | 1.15.11, 1.16.9, 1.17.5, 1.18.1 | ||
debian 14 | 1.18.2-1 | ||
go | v1.15.11, v1.16.9, v1.17.5, v1.18.1-beta.0 | ||
debian 13 | 1.18.2-1 |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3. 4. 5. 6. 7. 8. 9.