The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
The debugging endpoint `/debug/pprof` is exposed over the unauthenticated Kubelet healthz port. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration. If you are exposed we recommend upgrading to at least one of the versions listed.

**Am I vulnerable?**
By default, the Kubelet exposes unauthenticated healthz endpoints on port :10248, but only over localhost. If your nodes are using a non-localhost healthzBindAddress (--health-bind-address), and an older version, you may be vulnerable. If your nodes are using the default localhost healthzBindAddress, it is only exposed to pods or processes running in the host network namespace.

Run `kubectl get nodes` to see whether nodes are running a vulnerable version.

Run `kubectl get --raw /api/v1/nodes/${NODE_NAME}/proxy/configz` to check whether the "healthzBindAddress" is non-local.

**How do I mitigate the vulnerability?**
* Upgrade to a patched version (1.15.0+, 1.14.4+, 1.13.8+, or 1.12.10+)
* or, update node configurations to set the "healthzBindAddress" to "127.0.0.1".

https://github.com/kubernetes/kubernetes/pull/79184 fixed in 1.12.10
https://github.com/kubernetes/kubernetes/pull/79183 fixed in 1.13.8
https://github.com/kubernetes/kubernetes/pull/79182 fixed in 1.14.4
https://github.com/kubernetes/kubernetes/pull/78313 fixed in 1.15.0

**Vulnerability Details**
The `go pprof` endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service.

Thanks to Jordan Zebor of F5 Networks for reporting this problem.

/area security
/close
CVE-2019-11248: /debug/pprof exposed on kubelet's healthz port
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CVE-2019-11248: /debug/pprof exposed on kubelet's healthz port
Issue date:

--- start body ---
The debugging endpoint `/debug/pprof` is exposed over the unauthenticated Kubelet healthz port. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration. If you are exposed we recommend upgrading to at least one of the versions listed.

**Am I vulnerable?**
By default, the Kubelet exposes unauthenticated healthz endpoints on port :10248, but only over localhost. If your nodes are using a non-localhost healthzBindAddress (--health-bind-address), and an older version, you may be vulnerable. If your nodes are using the default localhost healthzBindAddress, it is only exposed to pods or processes running in the host network namespace.

Run `kubectl get nodes` to see whether nodes are running a vulnerable version.

Run `kubectl get --raw /api/v1/nodes/${NODE_NAME}/proxy/configz` to check whether the "healthzBindAddress" is non-local.

**How do I mitigate the vulnerability?**
* Upgrade to a patched version (1.15.0+, 1.14.4+, 1.13.8+, or 1.12.10+)
* or, update node configurations to set the "healthzBindAddress" to "127.0.0.1".

https://github.com/kubernetes/kubernetes/pull/79184 fixed in 1.12.10
https://github.com/kubernetes/kubernetes/pull/79183 fixed in 1.13.8
https://github.com/kubernetes/kubernetes/pull/79182 fixed in 1.14.4
https://github.com/kubernetes/kubernetes/pull/78313 fixed in 1.15.0

**Vulnerability Details**
The `go pprof` endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service.

Thanks to Jordan Zebor of F5 Networks for reporting this problem.

/area security
/close
--- end body ---
