mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 09:11:28 +00:00
398 lines
15 KiB
JSON
398 lines
15 KiB
JSON
{
|
|
"id": "CVE-2019-11248",
|
|
"sourceIdentifier": "jordan@liggitt.net",
|
|
"published": "2019-08-29T01:15:11.367",
|
|
"lastModified": "2020-10-05T13:50:49.213",
|
|
"vulnStatus": "Analyzed",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "El extremo de depuraci\u00f3n /debug/pprof se expone a trav\u00e9s del puerto de salud de Kubelet no autenticado. El punto final del pprof go se expone sobre el puerto healthz del Kubelet. Este extremo de depuraci\u00f3n puede filtrar informaci\u00f3n confidencial, como las direcciones internas de memoria y la configuraci\u00f3n de Kubelet, o por una denegaci\u00f3n de servicio limitada. Las versiones anteriores a 1.15.0, 1.14.4, 1.13.8 y 1.12.10 se ven afectadas. El problema es de gravedad media, pero no expuesto por la configuraci\u00f3n predeterminada."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "NONE",
|
|
"availabilityImpact": "LOW",
|
|
"baseScore": 8.2,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 4.2
|
|
}
|
|
],
|
|
"cvssMetricV30": [
|
|
{
|
|
"source": "jordan@liggitt.net",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "3.0",
|
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "NONE",
|
|
"availabilityImpact": "LOW",
|
|
"baseScore": 6.5,
|
|
"baseSeverity": "MEDIUM"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 2.5
|
|
}
|
|
],
|
|
"cvssMetricV2": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "2.0",
|
|
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
|
|
"accessVector": "NETWORK",
|
|
"accessComplexity": "LOW",
|
|
"authentication": "NONE",
|
|
"confidentialityImpact": "PARTIAL",
|
|
"integrityImpact": "NONE",
|
|
"availabilityImpact": "PARTIAL",
|
|
"baseScore": 6.4
|
|
},
|
|
"baseSeverity": "MEDIUM",
|
|
"exploitabilityScore": 10.0,
|
|
"impactScore": 4.9,
|
|
"acInsufInfo": false,
|
|
"obtainAllPrivilege": false,
|
|
"obtainUserPrivilege": false,
|
|
"obtainOtherPrivilege": false,
|
|
"userInteractionRequired": false
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-862"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"source": "jordan@liggitt.net",
|
|
"type": "Secondary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-419"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "1.12.10",
|
|
"matchCriteriaId": "EF491B76-31AF-401F-BDCA-2B825BD00B18"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.0:-:*:*:*:*:*:*",
|
|
"matchCriteriaId": "46561812-D492-4752-B461-726CB59ACF20"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.0:alpha0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "23A873E8-B8AA-4F44-B7D5-25F4C40CCA91"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.0:alpha1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "F708C4D8-12E6-4CBC-8ECD-A5F0F5EFDA39"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.0:alpha2:*:*:*:*:*:*",
|
|
"matchCriteriaId": "CA9EC2A9-1C77-4701-8F93-8000FF716AB4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.0:alpha3:*:*:*:*:*:*",
|
|
"matchCriteriaId": "2CBA108A-AE8C-4C6D-AEDC-22B628FAC588"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.0:beta0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "F82D886D-F427-45D1-B39B-51D7C1945AAB"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.0:beta1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "52E0AE58-9B46-4404-B83E-41A0AD5A4CC6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.0:beta2:*:*:*:*:*:*",
|
|
"matchCriteriaId": "579E840C-9FE1-4843-B93F-16D64D19A4DB"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.0:rc1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "4A0A3812-0619-4D6C-8192-96BDE9DBC809"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.0:rc2:*:*:*:*:*:*",
|
|
"matchCriteriaId": "14AD34AC-D1CB-4E37-B570-C902F6033D30"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.1:-:*:*:*:*:*:*",
|
|
"matchCriteriaId": "F69FEB72-F836-4AE3-99BB-3237A9011089"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.1:beta0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "2BD120EE-6A09-46FC-B6EB-40CD44B54450"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.2:-:*:*:*:*:*:*",
|
|
"matchCriteriaId": "ED1F6346-9C0B-4916-9FEF-9CFB1A19F977"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.2:beta0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "06674061-F269-4176-8A4B-6FF9D3E8A5B6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.3:-:*:*:*:*:*:*",
|
|
"matchCriteriaId": "FEEE7CFF-9B3E-4B76-AFF6-18626060F46B"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.3:beta0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "028EB2D3-3490-4D12-B2E4-C330B015F0E7"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.4:-:*:*:*:*:*:*",
|
|
"matchCriteriaId": "1B34DB5C-F1C0-42E3-A3E8-300C2E87FE04"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.4:beta0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "471B216A-3B92-4033-8E06-8523EA167132"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.5:-:*:*:*:*:*:*",
|
|
"matchCriteriaId": "A1E81600-D293-4B9B-BDB6-4057308A7876"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.5:beta0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "59EA6211-D671-42EC-BEAE-698CB47FD529"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.6:-:*:*:*:*:*:*",
|
|
"matchCriteriaId": "4DA1071A-7489-45B5-875C-D3F8401BC726"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.6:beta0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "4CC774DD-08F0-4AC4-A0A9-67F86A7ED2E5"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.7:-:*:*:*:*:*:*",
|
|
"matchCriteriaId": "BAE36DCA-CBFD-4536-9760-5B6BEF1FFDAF"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.7:beta.0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "AE75E512-849E-4153-A469-EB271DB58F2D"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.8:beta.0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "4CEF4BDF-5189-4FD9-8037-DD15E147F611"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:-:*:*:*:*:*:*",
|
|
"matchCriteriaId": "428B51D5-37DA-4C4D-A4BF-09F8CAB04A94"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "34A6AC2D-82C4-4E1F-8D9A-159E31A4F790"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "002991E8-6CC8-4F58-89B3-0B1AF2447DD5"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha2:*:*:*:*:*:*",
|
|
"matchCriteriaId": "9EA02FED-0377-4E4B-A86F-EE44F0E27360"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha3:*:*:*:*:*:*",
|
|
"matchCriteriaId": "1496A02B-29F5-4DD5-B9FE-B39C5B77E8CF"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:beta0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "59D7C9A1-A467-46A5-A03E-A04BD35287C7"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:beta1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "41BF2E7F-E6DB-4ED0-B943-247B4F592C7E"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:beta2:*:*:*:*:*:*",
|
|
"matchCriteriaId": "EF0406C1-854E-4B4D-AC1E-7DE304356030"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:rc1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "300E9B49-446B-406C-B219-360BD97D6EC1"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.1:-:*:*:*:*:*:*",
|
|
"matchCriteriaId": "3AEA05A4-1B15-4E86-AD77-9D0BC1822AC7"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.1:beta0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "FD7A10F0-A32E-4B56-8706-F09CE7914557"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.2:-:*:*:*:*:*:*",
|
|
"matchCriteriaId": "149679C2-2A81-4783-8CFD-13DC0FD5BE4B"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.2:beta0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "EB97EBDA-CC98-4D92-B3F9-1BFBB21898B8"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.3:-:*:*:*:*:*:*",
|
|
"matchCriteriaId": "3CBB6E83-04DF-4B19-B638-F1F3183BE8C2"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.3:beta0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "C6EB704F-AA52-4308-9451-9700EAB596F8"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.4:beta.0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "D72214C5-AA44-4937-A42A-C2FD1E0EF7D0"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.15.0:alpha0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "B87B49B8-1441-45B6-9A72-E3C5A278883D"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.15.0:alpha1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "5A14876D-D0FA-4883-AEC6-28E29F5E3CA7"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.15.0:alpha2:*:*:*:*:*:*",
|
|
"matchCriteriaId": "401E0997-C67F-471C-B596-92B9773A3AEF"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.15.0:alpha3:*:*:*:*:*:*",
|
|
"matchCriteriaId": "BF1B7B10-AC15-4022-BDC9-71CF82130E3B"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.15.0:beta0:*:*:*:*:*:*",
|
|
"matchCriteriaId": "550C5D3B-2C70-4411-A54D-3D07EAEFD7E7"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.15.0:beta1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "FE430085-EA45-43B6-8AF2-30AD462D0F69"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.15.0:beta2:*:*:*:*:*:*",
|
|
"matchCriteriaId": "5652A16C-F032-4FC0-BFEC-04768D259470"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.15.0:rc1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "874991D0-5C48-4D10-B2E4-51D6BE2298E4"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://github.com/kubernetes/kubernetes/issues/81023",
|
|
"source": "jordan@liggitt.net",
|
|
"tags": [
|
|
"Patch",
|
|
"Third Party Advisory"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://groups.google.com/d/msg/kubernetes-security-announce/pKELclHIov8/BEDtRELACQAJ",
|
|
"source": "jordan@liggitt.net",
|
|
"tags": [
|
|
"Mailing List",
|
|
"Third Party Advisory"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://security.netapp.com/advisory/ntap-20190919-0003/",
|
|
"source": "jordan@liggitt.net",
|
|
"tags": [
|
|
"Third Party Advisory"
|
|
]
|
|
}
|
|
]
|
|
} |