CVE-2018-1002102

LOW

Kubernetes < 1.14.0 - URL Redirection to Untrusted Site via Kubelet Streaming Endpoints

Title source: llm

Description

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.

References (2)

Core 2

Core References

Issue Tracking, Mitigation, Third Party Advisory x_refsource_confirm

https://github.com/kubernetes/kubernetes/issues/85867

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q56CULSH7F7BC4NPS67ZS23ZCLL5TIVK/

Scores

CVSS v3 2.6

EPSS 0.0062

EPSS Percentile 44.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

Details

CWE

CWE-601

Status published

Products (3)

fedoraproject/fedora 31

kubernetes/kubernetes 1.14.0 alpha0 (2 CPE variants)

kubernetes/kubernetes 1.10.0 - 1.13.13

Published Dec 05, 2019

Tracked Since Feb 18, 2026