Vulnetix
Try Vulnetix Request Demo
CVE-2019-11243 PUBLISHED CVSS 3.1 LOW

Reported by kubernetes · Published April 22, 2019

In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()

Risk Scores

CVSS v3.0
3.1
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected Products

VendorProductVersions
KubernetesKubernetesv1.12, v1.13
KubernetesKubernetesv1.12, v1.13

Timeline

References

Open in Interactive Console →