The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
EF491B76-31AF-401F-BDCA-2B825BD00B18
1.12.10
cpe:2.3:a:kubernetes:kubernetes:1.13.0:-:*:*:*:*:*:*
46561812-D492-4752-B461-726CB59ACF20
cpe:2.3:a:kubernetes:kubernetes:1.13.0:alpha0:*:*:*:*:*:*
23A873E8-B8AA-4F44-B7D5-25F4C40CCA91
cpe:2.3:a:kubernetes:kubernetes:1.13.0:alpha1:*:*:*:*:*:*
F708C4D8-12E6-4CBC-8ECD-A5F0F5EFDA39
cpe:2.3:a:kubernetes:kubernetes:1.13.0:alpha2:*:*:*:*:*:*
CA9EC2A9-1C77-4701-8F93-8000FF716AB4
cpe:2.3:a:kubernetes:kubernetes:1.13.0:alpha3:*:*:*:*:*:*
2CBA108A-AE8C-4C6D-AEDC-22B628FAC588
cpe:2.3:a:kubernetes:kubernetes:1.13.0:beta0:*:*:*:*:*:*
F82D886D-F427-45D1-B39B-51D7C1945AAB
cpe:2.3:a:kubernetes:kubernetes:1.13.0:beta1:*:*:*:*:*:*
52E0AE58-9B46-4404-B83E-41A0AD5A4CC6
cpe:2.3:a:kubernetes:kubernetes:1.13.0:beta2:*:*:*:*:*:*
579E840C-9FE1-4843-B93F-16D64D19A4DB
cpe:2.3:a:kubernetes:kubernetes:1.13.0:rc1:*:*:*:*:*:*
4A0A3812-0619-4D6C-8192-96BDE9DBC809
cpe:2.3:a:kubernetes:kubernetes:1.13.0:rc2:*:*:*:*:*:*
14AD34AC-D1CB-4E37-B570-C902F6033D30
cpe:2.3:a:kubernetes:kubernetes:1.13.1:-:*:*:*:*:*:*
F69FEB72-F836-4AE3-99BB-3237A9011089
cpe:2.3:a:kubernetes:kubernetes:1.13.1:beta0:*:*:*:*:*:*
2BD120EE-6A09-46FC-B6EB-40CD44B54450
cpe:2.3:a:kubernetes:kubernetes:1.13.2:-:*:*:*:*:*:*
ED1F6346-9C0B-4916-9FEF-9CFB1A19F977
cpe:2.3:a:kubernetes:kubernetes:1.13.2:beta0:*:*:*:*:*:*
06674061-F269-4176-8A4B-6FF9D3E8A5B6
cpe:2.3:a:kubernetes:kubernetes:1.13.3:-:*:*:*:*:*:*
FEEE7CFF-9B3E-4B76-AFF6-18626060F46B
cpe:2.3:a:kubernetes:kubernetes:1.13.3:beta0:*:*:*:*:*:*
028EB2D3-3490-4D12-B2E4-C330B015F0E7
cpe:2.3:a:kubernetes:kubernetes:1.13.4:-:*:*:*:*:*:*
1B34DB5C-F1C0-42E3-A3E8-300C2E87FE04
cpe:2.3:a:kubernetes:kubernetes:1.13.4:beta0:*:*:*:*:*:*
471B216A-3B92-4033-8E06-8523EA167132
cpe:2.3:a:kubernetes:kubernetes:1.13.5:-:*:*:*:*:*:*
A1E81600-D293-4B9B-BDB6-4057308A7876
cpe:2.3:a:kubernetes:kubernetes:1.13.5:beta0:*:*:*:*:*:*
59EA6211-D671-42EC-BEAE-698CB47FD529
cpe:2.3:a:kubernetes:kubernetes:1.13.6:-:*:*:*:*:*:*
4DA1071A-7489-45B5-875C-D3F8401BC726
cpe:2.3:a:kubernetes:kubernetes:1.13.6:beta0:*:*:*:*:*:*
4CC774DD-08F0-4AC4-A0A9-67F86A7ED2E5
cpe:2.3:a:kubernetes:kubernetes:1.13.7:-:*:*:*:*:*:*
BAE36DCA-CBFD-4536-9760-5B6BEF1FFDAF
cpe:2.3:a:kubernetes:kubernetes:1.13.7:beta.0:*:*:*:*:*:*
AE75E512-849E-4153-A469-EB271DB58F2D
cpe:2.3:a:kubernetes:kubernetes:1.13.8:beta.0:*:*:*:*:*:*
4CEF4BDF-5189-4FD9-8037-DD15E147F611
cpe:2.3:a:kubernetes:kubernetes:1.14.0:-:*:*:*:*:*:*
428B51D5-37DA-4C4D-A4BF-09F8CAB04A94
cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha0:*:*:*:*:*:*
34A6AC2D-82C4-4E1F-8D9A-159E31A4F790
cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha1:*:*:*:*:*:*
002991E8-6CC8-4F58-89B3-0B1AF2447DD5
cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha2:*:*:*:*:*:*
9EA02FED-0377-4E4B-A86F-EE44F0E27360
cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha3:*:*:*:*:*:*
1496A02B-29F5-4DD5-B9FE-B39C5B77E8CF
cpe:2.3:a:kubernetes:kubernetes:1.14.0:beta0:*:*:*:*:*:*
59D7C9A1-A467-46A5-A03E-A04BD35287C7
cpe:2.3:a:kubernetes:kubernetes:1.14.0:beta1:*:*:*:*:*:*
41BF2E7F-E6DB-4ED0-B943-247B4F592C7E
cpe:2.3:a:kubernetes:kubernetes:1.14.0:beta2:*:*:*:*:*:*
EF0406C1-854E-4B4D-AC1E-7DE304356030
cpe:2.3:a:kubernetes:kubernetes:1.14.0:rc1:*:*:*:*:*:*
300E9B49-446B-406C-B219-360BD97D6EC1
cpe:2.3:a:kubernetes:kubernetes:1.14.1:-:*:*:*:*:*:*
3AEA05A4-1B15-4E86-AD77-9D0BC1822AC7
cpe:2.3:a:kubernetes:kubernetes:1.14.1:beta0:*:*:*:*:*:*
FD7A10F0-A32E-4B56-8706-F09CE7914557
cpe:2.3:a:kubernetes:kubernetes:1.14.2:-:*:*:*:*:*:*
149679C2-2A81-4783-8CFD-13DC0FD5BE4B
cpe:2.3:a:kubernetes:kubernetes:1.14.2:beta0:*:*:*:*:*:*
EB97EBDA-CC98-4D92-B3F9-1BFBB21898B8
cpe:2.3:a:kubernetes:kubernetes:1.14.3:-:*:*:*:*:*:*
3CBB6E83-04DF-4B19-B638-F1F3183BE8C2
cpe:2.3:a:kubernetes:kubernetes:1.14.3:beta0:*:*:*:*:*:*
C6EB704F-AA52-4308-9451-9700EAB596F8
cpe:2.3:a:kubernetes:kubernetes:1.14.4:beta.0:*:*:*:*:*:*
D72214C5-AA44-4937-A42A-C2FD1E0EF7D0
cpe:2.3:a:kubernetes:kubernetes:1.15.0:alpha0:*:*:*:*:*:*
B87B49B8-1441-45B6-9A72-E3C5A278883D
cpe:2.3:a:kubernetes:kubernetes:1.15.0:alpha1:*:*:*:*:*:*
5A14876D-D0FA-4883-AEC6-28E29F5E3CA7
cpe:2.3:a:kubernetes:kubernetes:1.15.0:alpha2:*:*:*:*:*:*
401E0997-C67F-471C-B596-92B9773A3AEF
cpe:2.3:a:kubernetes:kubernetes:1.15.0:alpha3:*:*:*:*:*:*
BF1B7B10-AC15-4022-BDC9-71CF82130E3B
cpe:2.3:a:kubernetes:kubernetes:1.15.0:beta0:*:*:*:*:*:*
550C5D3B-2C70-4411-A54D-3D07EAEFD7E7
cpe:2.3:a:kubernetes:kubernetes:1.15.0:beta1:*:*:*:*:*:*
FE430085-EA45-43B6-8AF2-30AD462D0F69
cpe:2.3:a:kubernetes:kubernetes:1.15.0:beta2:*:*:*:*:*:*
5652A16C-F032-4FC0-BFEC-04768D259470
cpe:2.3:a:kubernetes:kubernetes:1.15.0:rc1:*:*:*:*:*:*
874991D0-5C48-4D10-B2E4-51D6BE2298E4
OR
The debugging endpoint `/debug/pprof` is exposed over the unauthenticated Kubelet healthz port. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration. If you are exposed we recommend upgrading to at least one of the versions listed.

**Am I vulnerable?**
By default, the Kubelet exposes unauthenticated healthz endpoints on port :10248, but only over localhost. If your nodes are using a non-localhost healthzBindAddress (--health-bind-address), and an older version, you may be vulnerable. If your nodes are using the default localhost healthzBindAddress, it is only exposed to pods or processes running in the host network namespace.

Run `kubectl get nodes` to see whether nodes are running a vulnerable version.

Run `kubectl get --raw /api/v1/nodes/${NODE_NAME}/proxy/configz` to check whether the "healthzBindAddress" is non-local.

**How do I mitigate the vulnerability?**
* Upgrade to a patched version (1.15.0+, 1.14.4+, 1.13.8+, or 1.12.10+)
* or, update node configurations to set the "healthzBindAddress" to "127.0.0.1".

https://github.com/kubernetes/kubernetes/pull/79184 fixed in 1.12.10
https://github.com/kubernetes/kubernetes/pull/79183 fixed in 1.13.8
https://github.com/kubernetes/kubernetes/pull/79182 fixed in 1.14.4
https://github.com/kubernetes/kubernetes/pull/78313 fixed in 1.15.0

**Vulnerability Details**
The `go pprof` endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service.

Thanks to Jordan Zebor of F5 Networks for reporting this problem.

/area security
/close
CVE-2019-11248: /debug/pprof exposed on kubelet's healthz port
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CVE-2019-11248: /debug/pprof exposed on kubelet's healthz port
Issue date:

--- start body ---
The debugging endpoint `/debug/pprof` is exposed over the unauthenticated Kubelet healthz port. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration. If you are exposed we recommend upgrading to at least one of the versions listed.

**Am I vulnerable?**
By default, the Kubelet exposes unauthenticated healthz endpoints on port :10248, but only over localhost. If your nodes are using a non-localhost healthzBindAddress (--health-bind-address), and an older version, you may be vulnerable. If your nodes are using the default localhost healthzBindAddress, it is only exposed to pods or processes running in the host network namespace.

Run `kubectl get nodes` to see whether nodes are running a vulnerable version.

Run `kubectl get --raw /api/v1/nodes/${NODE_NAME}/proxy/configz` to check whether the "healthzBindAddress" is non-local.

**How do I mitigate the vulnerability?**
* Upgrade to a patched version (1.15.0+, 1.14.4+, 1.13.8+, or 1.12.10+)
* or, update node configurations to set the "healthzBindAddress" to "127.0.0.1".

https://github.com/kubernetes/kubernetes/pull/79184 fixed in 1.12.10
https://github.com/kubernetes/kubernetes/pull/79183 fixed in 1.13.8
https://github.com/kubernetes/kubernetes/pull/79182 fixed in 1.14.4
https://github.com/kubernetes/kubernetes/pull/78313 fixed in 1.15.0

**Vulnerability Details**
The `go pprof` endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service.

Thanks to Jordan Zebor of F5 Networks for reporting this problem.

/area security
/close
--- end body ---

comments :
--- start comments ---

--- end comments ---