The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5765 advisory.

  - In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
    The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of     14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at     100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement     nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of     settings entries are large (e.g., > 32), then drop the connection. (CVE-2020-11080)

  - An improper link resolution vulnerability affects Kata Containers versions prior to 1.11.0. Upon container     teardown, a malicious guest can trick the kata-runtime into unmounting any mount point on the host and all     mount points underneath it, potentiality resulting in a host DoS. (CVE-2020-2024)

  - Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying     image file on the host. A malicious guest can overwrite the image file to gain control of all subsequent     guest VMs. Since Kata Containers uses the same VM image file with all VMMs, this issue may also affect     QEMU and Firecracker based guests. (CVE-2020-2025)

  - A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running     multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any     host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11     versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and     earlier versions. (CVE-2020-2026)

  - The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account     for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by     kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod.
    If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node     and cause the node to fail. (CVE-2020-8557)

  - A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all     versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens     and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio     configuration. (CVE-2020-1764)

  - The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6     are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to     escalate privileges from a node compromise to a full cluster compromise. (CVE-2020-8559)

  - Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry     v2 is enabled: by sending a specially crafted packet, an attacker could trigger a Null Pointer Exception     resulting in a Denial of Service. This could be sent to the ingress gateway or a sidecar, triggering a     null pointer exception which results in a denial of service. This also affects servicemesh-proxy where a     null pointer exception flaw was found in servicemesh-proxy. When running Telemetry v2 (not on by default     in version 1.4.x), an attacker could send a specially crafted packet to the ingress gateway or proxy     sidecar, triggering a denial of service. (CVE-2020-10739)

  - In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would     incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with     a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only     allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and     validating a server TLS certificate for upstream connections. This vulnerability is only applicable to     situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which     you only intend to trust a subdomain of. For example, if you intend to trust api.mysubdomain.example.com,     and an untrusted actor can obtain a signed TLS certificate for *.example.com or *.com. Configurations are     vulnerable if they use verify_subject_alt_name in any Envoy version, or if they use     match_subject_alt_names in version 1.14 or later. This issue has been fixed in Envoy versions 1.12.6,     1.13.4, 1.14.4, 1.15.0. (CVE-2020-15104)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5766 advisory.

  - An improper link resolution vulnerability affects Kata Containers versions prior to 1.11.0. Upon container     teardown, a malicious guest can trick the kata-runtime into unmounting any mount point on the host and all     mount points underneath it, potentiality resulting in a host DoS. (CVE-2020-2024)

  - Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying     image file on the host. A malicious guest can overwrite the image file to gain control of all subsequent     guest VMs. Since Kata Containers uses the same VM image file with all VMMs, this issue may also affect     QEMU and Firecracker based guests. (CVE-2020-2025)

  - A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running     multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any     host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11     versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and     earlier versions. (CVE-2020-2026)

  - The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account     for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by     kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod.
    If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node     and cause the node to fail. (CVE-2020-8557)

  - The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6     are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to     escalate privileges from a node compromise to a full cluster compromise. (CVE-2020-8559)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5767 advisory.

  - The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account     for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by     kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod.
    If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node     and cause the node to fail. (CVE-2020-8557)

  - The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6     are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to     escalate privileges from a node compromise to a full cluster compromise. (CVE-2020-8559)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:0030 advisory.

  - kubernetes: compromised node could escalate to cluster level privileges (CVE-2020-8559)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5363 advisory.

  - kubernetes: improper validation of URL redirection in the Kubernetes API server allows an attacker-     controlled Kubelet to redirect API server requests from streaming endpoints (CVE-2018-1002102)

  - kubernetes: compromised node could escalate to cluster level privileges (CVE-2020-8559)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the kubernetes package has been released.

ID	Name	Product	Family	Severity
180974	Oracle Linux 7 : Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes kubernetes istio olcne (ELSA-2020-5765)	Nessus	Oracle Linux Local Security Checks	high
180954	Oracle Linux 7 : Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes olcne (ELSA-2020-5766)	Nessus	Oracle Linux Local Security Checks	high
180914	Oracle Linux 7 : kubernetes (ELSA-2020-5767)	Nessus	Oracle Linux Local Security Checks	medium
144942	RHEL 7 / 8 : OpenShift Container Platform 4.4.32 packages and (RHSA-2021:0030)	Nessus	Red Hat Local Security Checks	medium
144410	RHEL 7 : OpenShift Container Platform 3.11.346 (RHSA-2020:5363)	Nessus	Red Hat Local Security Checks	medium
140715	Photon OS 2.0: Kubernetes PHSA-2020-2.0-0285	Nessus	PhotonOS Local Security Checks	medium
140706	Photon OS 3.0: Kubernetes PHSA-2020-3.0-0142	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2020-8559

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium