Skip to content
CVE PROGRAM SOURCE RECORD6.4 Medium

CVE-2020-8559

Privilege escalation from compromised node to cluster

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
kubernetes

Description

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Kubernetes Kubernetes

  • 1.6affected
  • 1.7affected
  • 1.8affected
  • 1.9affected
  • 1.10affected
  • 1.11affected
  • 1.12affected
  • 1.13affected
  • 1.14affected
  • 1.15affected
  • 1.16 to ≤ 1.16.12affected
  • 1.17 to ≤ 1.17.8affected
  • 1.18 to ≤ 1.18.5affected

References