CVE-2019-11247

Summary

The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.

Affected Software

VendorProductVersion RangeStatus
KubernetesKubernetesprior to 1.13.9affected
KubernetesKubernetesprior to 1.14.5affected
KubernetesKubernetesprior to 1.15.2affected
KubernetesKubernetes1.7affected
KubernetesKubernetes1.8affected
KubernetesKubernetes1.9affected
KubernetesKubernetes1.10affected
KubernetesKubernetes1.11affected
KubernetesKubernetes1.12affected

Weaknesses

  • CWE-20: CWE-20: Improper Input Validation

Workarounds

To mitigate, remove authorization rules that grant access to cluster-scoped resources within namespaces. For example, RBAC roles and clusterroles intended to be referenced by namespaced rolebindings should not grant access to resources:[], apiGroups:[], or grant access to cluster-scoped custom resources.

ADP Enrichment

CVE Program Container

Additional References

References