CVE-2019-11243: High severity kubernetes dashboard vulnerability
In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11243?
The severity of CVE-2019-11243 is high with a CVSS score of 8.1.
What is the affected software for CVE-2019-11243?
The affected software for CVE-2019-11243 includes Kubernetes versions 1.12.0 to 1.12.4 and version 1.13.0 as well as Netapp Trident.
How does the rest.AnonymousClientConfig() method work in the affected versions?
In the affected versions, the rest.AnonymousClientConfig() method returns a copy of the provided config with credentials removed, such as the bearer token, username/password, and client certificate/key data.
What is the reference for CVE-2019-11243?
The references for CVE-2019-11243 include the following: SecurityFocus BID 108053, GitHub issue #76797, and Netapp advisory NTAP-20190509-0002.
How can I fix CVE-2019-11243?
To fix CVE-2019-11243, it is recommended to upgrade to a non-vulnerable version of Kubernetes or apply the necessary patches and updates provided by the vendor.