CVE-2019-11247: Kubernetes kube-apiserver allows access to custom resources via wrong scope
The Kubernetes API server mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges).
Other sources
The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-11247?
CVE-2019-11247 is a vulnerability in the Kubernetes kube-apiserver that allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced.
How severe is CVE-2019-11247?
CVE-2019-11247 has a severity rating of 8.1, which is considered high.
What software is affected by CVE-2019-11247?
Kubernetes versions between 1.7.0 and 1.12.10, 1.13.0 and 1.13.9, and 1.14.0 and 1.14.5 are affected by CVE-2019-11247, as well as Redhat Openshift Container Platform 3.9, 3.10, and 3.11.
What is the remedy for CVE-2019-11247?
To fix CVE-2019-11247, users should update to k8s.io/apiextensions-apiserver version 0.15.2, 0.14.5, or 0.13.9 depending on the affected Kubernetes version.
Where can I find more information about CVE-2019-11247?
More information about CVE-2019-11247 can be found on the CVE website (https://www.cve.org/CVERecord?id=CVE-2019-11247), NIST National Vulnerability Database (https://nvd.nist.gov/vuln/detail/CVE-2019-11247), and Redhat Bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=1732192).