The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2992 advisory.

  - cri-o: infra container reparented to systemd following OOM Killer killing it's conmon (CVE-2019-14891)

  - nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

  - kubernetes: Use of unbounded 'client' label in apiserver_request_total allows for memory exhaustion     (CVE-2020-8552)

  - kubernetes: node localhost services reachable via martian packets (CVE-2020-8558)

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1527 advisory.

  - kubernetes: Use of unbounded 'client' label in apiserver_request_total allows for memory exhaustion     (CVE-2020-8552)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been     found to be vulnerable to a denial of service attack via successful API requests. (CVE-2020-8552)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been
    found to be vulnerable to a denial of service attack via successful API requests. (CVE-2020-8552)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2992 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * cri-o: A flaw was found in cri-o that can result in container management (conmon) processes being killed     if a workload process triggers an out-of-memory (OOM) condition for the cgroup. (CVE-2019-14891)

    * nodejs-minimist: Prototype pollution allows adding or modifying properties of Object.prototype using a     `constructor` or `__proto__` payload. (CVE-2020-7598)

    * kubernetes: Use of unbounded 'client' label in apiserver_request_total allows repeated, crafted HTTP     requests to exhaust available memory and cause a crash. (CVE-2020-8552)

    * kubernetes: A flaw was found in Kubernetes that allows attackers on adjacent networks to reach services     exposed on localhost ports and gain privileges or access confidential information for any services     listening on localhost ports that are not protected by authentication. (CVE-2020-8558)

    * proglottis/gpgme: A use-after-free vulnerability was found in the Go GPGME wrapper library,     github.com/proglottis/gpgme. (CVE-2020-8945)

    * openshift/console: A flaw allowed text injection on error pages with a crafted URL. (CVE-2020-10715)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Security fix for CVE-2020-8551, CVE-2020-8552,     CVE-2020-8555, CVE-2020-8945

  - Rebase to head of usptream 3.11 branch

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the kubernetes package has been released.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1527 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * kubernetes: Use of unbounded 'client' label in apiserver_request_total allowed for memory exhaustion     (CVE-2020-8552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
312533	RHCOS 3 : OpenShift Container Platform 3.11 (RHSA-2020:2992)	Nessus	Red Hat Local Security Checks	high
312485	RHCOS 4 : OpenShift Container Platform 4.2.29 openshift (RHSA-2020:1527)	Nessus	Red Hat Local Security Checks	medium
259146	Linux Distros Unpatched Vulnerability : CVE-2020-8552	Nessus	Misc.	medium
412363	SCA: security update for k8s.io/apiserver (GHSA-82hx-w2r5-c2wq)	Tenable Cloud Security	SCA Checks	medium
412363	SCA: security update for k8s.io/apiserver (GHSA-82hx-w2r5-c2wq)	Tenable Self-Hosted Container Security	SCA Checks	medium
139006	RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:2992)	Nessus	Red Hat Local Security Checks	high
138918	Fedora 32 : origin (2020-aeea04cd13)	Nessus	Fedora Local Security Checks	high
136099	Photon OS 3.0: Kubernetes PHSA-2020-3.0-0084	Nessus	PhotonOS Local Security Checks	medium
136033	Photon OS 1.0: Kubernetes PHSA-2020-1.0-0289	Nessus	PhotonOS Local Security Checks	medium
135874	RHEL 7 / 8 : OpenShift Container Platform 4.2.29 openshift (RHSA-2020:1527)	Nessus	Red Hat Local Security Checks	medium
135869	Photon OS 2.0: Kubernetes PHSA-2020-2.0-0229	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2020-8552

medium

Tenable Plugins

high

medium

medium

medium

medium

high

high

medium

medium

medium

medium