CVE-2019-11248: Kubernetes kubelet exposes /debug/pprof info on healthz port
The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-11248?
CVE-2019-11248 is a vulnerability in Kubernetes where the debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port, potentially leaking sensitive information.
What is the severity of CVE-2019-11248?
CVE-2019-11248 has a severity score of 8.2, which is considered high.
Can this vulnerability affect Kubernetes versions 1.14.2 and below?
No, this vulnerability only affects Kubernetes versions 1.14.3 and above.
How can I fix CVE-2019-11248?
To fix CVE-2019-11248, you should upgrade your Kubernetes cluster to version 1.14.3 or above.
Where can I find more information about CVE-2019-11248?
You can find more information about CVE-2019-11248 on the Kubernetes GitHub page and the Kubernetes Security Announce group.