Note:
This project will be discontinued after December 13, 2021. [more]
2019-12-05
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.
| Products | Fedora, Kubernetes |
| Type | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) |
| First patch | - None (likely due to unavailable code) |
| Links |
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q56CULSH7F7BC4NPS67ZS23ZCLL5TIVK/
• https://github.com/kubernetes/kubernetes/issues/85867 |