CVE-2019-11247

CVE Details

Release Date:

2019-08-28

Description

The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.

See more information about CVE-2019-11247 from MITRE CVE dictionary and NIST NVD

CVSS v3.0 metrics

NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.

Base Score:	8.1	Base Metrics:	AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Access Vector:	Network	Attack Complexity:	Low
Privileges Required:	Low	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	High
Integrity Impact:	High	Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 7 (kubeadm-ha-setup)	ELSA-2019-4816	2020-01-31
Oracle Linux version 7 (kubeadm-upgrade)	ELSA-2019-4816	2020-01-31
Oracle Linux version 7 (kubernetes)	ELSA-2019-4816	2020-01-31

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team