Permissions, Privileges, and Access Controls in k3s (Alpine package)



Risk High
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2019-11247
CWE-ID CWE-264
Exploitation vector Network
Public exploit N/A
Vulnerable software
 k3s (Alpine package)
Operating systems & Components / Operating system package or component

Vendor Alpine Linux Development Team

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU30804

Risk: High

CVSSv4.0: 6.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-11247

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to read and manipulate data.

The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.

Mitigation

Install update from vendor's website.

Vulnerable software versions

k3s (Alpine package): 0.7.0-r0

CPE2.3 External links

https://git.alpinelinux.org/aports/commit/?id=bd6c2b0202fd22c3155ba217e76bcb1164da3fa8


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###