Skip to content
Fencer Vulns
critical 9.8

CVE-2018-1002105 in the critical feed json

Privilege Escalation in Kubernetes

published 2018-12-05 7 y ago modified 2026-09-10 1 mo ago also GHSA-579h-mv94-g4gp , GO-2022-0792 , EUVD-2022-0831

cvss
9.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
87.0%
EPSS 87.0% chance of exploitation in 30 days, percentile 99.7%
public exploits
2
Exploit-DB

Summary

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.

Patch / fix

  • go github.com/kubernetes/kubernetes 1.10.11, 1.11.5, 1.12.3
  • Kubernetes Kubernetes v1.10.11, v1.11.5, v1.12.3
  • kubernetes Debian 14, Debian 13, Debian 12 1.17.4-1

debian advisories DEBIAN-CVE-2018-1002105

  • atomic-openshift openshift 3.2 3.2.1.34-2.git.20.6367d5d.el7
  • atomic-openshift-pod openshift 3.2 3.2.1.34-2.git.20.6367d5d.el7
  • atomic-openshift-node openshift 3.2 3.2.1.34-2.git.20.6367d5d.el7
  • atomic-openshift-tests openshift 3.2 3.2.1.34-2.git.20.6367d5d.el7
  • atomic-openshift-master openshift 3.2 3.2.1.34-2.git.20.6367d5d.el7
  • atomic-openshift-clients openshift 3.2 3.2.1.34-2.git.20.6367d5d.el7
  • atomic-openshift-recycle openshift 3.2 3.2.1.34-2.git.20.6367d5d.el7
  • atomic-openshift-sdn-ovs openshift 3.2 3.2.1.34-2.git.20.6367d5d.el7

red hat advisories RHSA-2018:3742RHSA-2018:3754RHSA-2018:3752RHSA-2018:3624RHSA-2018:3598RHSA-2018:3549

  • kubernetes openSUSE Leap 15.1 1.18.0-lp151.5.1
  • cri-o openSUSE Leap 15.1 1.17.1-lp151.2.2
  • go1.14 openSUSE Leap 15.1 1.14-lp151.6.1
  • cri-tools openSUSE Leap 15.1 1.18.0-lp151.2.1

opensuse advisories openSUSE-SU-2020:0554-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1002105 updated cvss 8.8

kubernetes: authentication/authorization bypass in the handling of non-101 responses

  • Red Hat OpenShift Enterprise 3.0 openshift, openshift-node, openshift-master, openshift-clients, openshift-sdn-ovs, tuned-profiles-openshift-node
    affected: workaround, no fix planned “See the vulnerability article for mitigation procedures.”
  • Red Hat OpenShift Container Platform 3.2 atomic-openshift 3.2.1.34-2.git.20.6367d5d.el7, atomic-openshift-pod 3.2.1.34-2.git.20.6367d5d.el7, atomic-openshift-node 3.2.1.34-2.git.20.6367d5d.el7, atomic-openshift-tests 3.2.1.34-2.git.20.6367d5d.el7, atomic-openshift-master 3.2.1.34-2.git.20.6367d5d.el7, atomic-openshift-clients 3.2.1.34-2.git.20.6367d5d.el7, +7 more
    fixed: vendor fix “See the vulnerability article for mitigation procedures.” RHSA-2018:3742
  • Red Hat OpenShift Container Platform 3.3 openshift-ansible 3.3.149-1.git.0.3859ddb.el7, atomic-openshift 3.3.1.46.45-1.git.0.2ce596e.el7, atomic-openshift-utils 3.3.149-1.git.0.3859ddb.el7, openshift-ansible-roles 3.3.149-1.git.0.3859ddb.el7, atomic-openshift-pod 3.3.1.46.45-1.git.0.2ce596e.el7, atomic-openshift-node 3.3.1.46.45-1.git.0.2ce596e.el7, +13 more
    fixed: vendor fix “See the vulnerability article for mitigation procedures.” RHSA-2018:3754
  • Red Hat OpenShift Container Platform 3.4 openshift-ansible 3.4.172-1.git.0.33fe526.el7, atomic-openshift 3.4.1.44.57-1.git.0.a631031.el7, atomic-openshift-utils 3.4.172-1.git.0.33fe526.el7, openshift-ansible-roles 3.4.172-1.git.0.33fe526.el7, atomic-openshift-pod 3.4.1.44.57-1.git.0.a631031.el7, atomic-openshift-node 3.4.1.44.57-1.git.0.a631031.el7, +13 more
    fixed: vendor fix “See the vulnerability article for mitigation procedures.” RHSA-2018:3752
  • Red Hat OpenShift Container Platform 3.5 cockpit 160-3.el7, cockpit-kubernetes 160-3.el7, openshift-ansible 3.5.175-1.git.0.1274ebe.el7, atomic-openshift 3.5.5.31.80-1.git.0.c4a0780.el7, atomic-openshift-utils 3.5.175-1.git.0.1274ebe.el7, openshift-ansible-roles 3.5.175-1.git.0.1274ebe.el7, +15 more
    fixed: vendor fix “See the vulnerability article for mitigation procedures.” RHSA-2018:3624
  • Red Hat OpenShift Container Platform 3.6 atomic-openshift 3.6.173.0.140-1.git.0.9686d52.el7, openshift-ansible 3.6.173.0.140-1.git.0.0ccb19b.el7, atomic-openshift-pod 3.6.173.0.140-1.git.0.9686d52.el7, atomic-openshift-node 3.6.173.0.140-1.git.0.9686d52.el7, atomic-openshift-tests 3.6.173.0.140-1.git.0.9686d52.el7, atomic-openshift-utils 3.6.173.0.140-1.git.0.0ccb19b.el7, +16 more
    fixed: vendor fix “See the vulnerability article for mitigation procedures.” RHSA-2018:3598
  • Red Hat OpenShift Container Platform 3.7 atomic-openshift 3.7.72-1.git.0.925b9cd.el7, openshift-ansible 3.7.72-1.git.0.5c45a8a.el7, atomic-openshift-pod 3.7.72-1.git.0.925b9cd.el7, atomic-openshift-node 3.7.72-1.git.0.925b9cd.el7, atomic-openshift-tests 3.7.72-1.git.0.925b9cd.el7, atomic-openshift-utils 3.7.72-1.git.0.5c45a8a.el7, +17 more
    fixed: vendor fix “See the vulnerability article for mitigation procedures.” RHSA-2018:2906
  • Red Hat OpenShift Container Platform 3.8 atomic-openshift 3.8.44-1.git.0.9be0abd.el7, atomic-openshift-pod 3.8.44-1.git.0.9be0abd.el7, atomic-openshift-node 3.8.44-1.git.0.9be0abd.el7, atomic-openshift-tests 3.8.44-1.git.0.9be0abd.el7, atomic-openshift-master 3.8.44-1.git.0.9be0abd.el7, atomic-openshift-clients 3.8.44-1.git.0.9be0abd.el7, +9 more
    fixed: vendor fix “See the vulnerability article for mitigation procedures.” RHSA-2018:3551
show 4 more
  • Red Hat OpenShift Container Platform 3.9 atomic-openshift 3.9.51-1.git.0.dc3a40b.el7, atomic-openshift-pod 3.9.51-1.git.0.dc3a40b.el7, atomic-openshift-node 3.9.51-1.git.0.dc3a40b.el7, atomic-openshift-tests 3.9.51-1.git.0.dc3a40b.el7, atomic-openshift-master 3.9.51-1.git.0.dc3a40b.el7, atomic-openshift-clients 3.9.51-1.git.0.dc3a40b.el7, +8 more
    fixed: vendor fix “See the vulnerability article for mitigation procedures.” RHSA-2018:2908
  • Red Hat OpenShift Container Platform 3.10 atomic-openshift 3.10.72-1.git.0.3cb2fdc.el7, openshift-ansible 3.10.73-1.git.0.8b65cea.el7, atomic-openshift-pod 3.10.72-1.git.0.3cb2fdc.el7, atomic-openshift-node 3.10.72-1.git.0.3cb2fdc.el7, atomic-openshift-tests 3.10.72-1.git.0.3cb2fdc.el7, atomic-openshift-master 3.10.72-1.git.0.3cb2fdc.el7, +21 more
    fixed: vendor fix “See the vulnerability article for mitigation procedures.” RHSA-2018:3549
  • Red Hat OpenShift Container Platform 3.11 atomic-openshift 3.11.43-1.git.0.647ac05.el7, atomic-openshift-pod 3.11.43-1.git.0.647ac05.el7, atomic-openshift-node 3.11.43-1.git.0.647ac05.el7, atomic-openshift-tests 3.11.43-1.git.0.647ac05.el7, atomic-openshift-master 3.11.43-1.git.0.647ac05.el7, atomic-openshift-sdn-ovs 3.11.43-1.git.0.647ac05.el7, +6 more
    fixed: vendor fix “See the vulnerability article for mitigation procedures.” RHSA-2018:3537
  • Red Hat OpenShift Container Platform 3.8 python-paramiko 2.1.1-4.el7, atomic-openshift-descheduler 0.3.0-1.el7, openshift-ansible 3.8.44-1.git.0.2bfde74.el7, atomic-openshift-utils 3.8.44-1.git.0.2bfde74.el7, atomic-openshift-node-problem-detector 3.7.0-0.el7, openshift-ansible-roles 3.8.44-1.git.0.2bfde74.el7, +2 more Red Hat OpenShift Container Platform 3.9 fluentd 0.12.43-3.el7, openshift-ansible 3.9.51-1.git.0.c4968ca.el7, atomic-openshift-utils 3.9.51-1.git.0.c4968ca.el7, openshift-ansible-roles 3.9.51-1.git.0.c4968ca.el7, openshift-ansible-playbooks 3.9.51-1.git.0.c4968ca.el7, prometheus-node-exporter 3.9.51-1.git.1060.2055e02.el7, +5 more Red Hat OpenShift Container Platform 3.11 kibana 5.6.12-1.el7, python-nose-xcover 1.0.10-1.el7, python-elasticsearch 5.5.5-1.el7, cri-o 1.11.8-2.rhaos3.11.git71cc465.el7, jenkins-2-plugins 3.11.1539805268-1.el7, prometheus 3.11.43-1.git.5021.31a8f1d.el7, +30 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (EDB-46053)

Exploit prediction

86.98% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-46053 Kubernetes - (Authenticated) Arbitrary Requests remote, 2018-12-10
  • EDB-46052 Kubernetes - (Unauthenticated) Arbitrary Requests remote, 2018-12-10
  • github.com https://github.com/evict/poc_CVE-2018-1002105 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/kubernetes/kubernetes
<1.10.11
>=1.11.0, <1.11.5
>=1.12.0, <1.12.3
1.10.11
1.11.5
1.12.3

Affected products

  • Kubernetes Kubernetes

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.