CVE-2020-8558
Description
A flaw was found in Kubernetes that allows attackers on adjacent networks to reach services exposed on localhost ports, previously thought to be unreachable. This flaw allows an attacker to gain privileges or access confidential information for any services listening on localhost ports that are not protected by authentication.
Statement
OpenShift Container Platform does not expose the API server on a localhost port without authentication. The only service exposed on a localhost port not protected by authentication is Metrics, which exposes some cluster metadata.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.4 | 8.8 | N/A |
| Attack Vector | Adjacent Network | Adjacent Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | Low | High | N/A |
| Integrity Impact | Low | High | N/A |
| Availability Impact | None | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
OpenShift Container Platform does not expose the API server on a localhost port without authentication. The only service exposed on a localhost port not protected by authentication is Metrics, which exposes some cluster metadata. OpenShift therefore uses the same medium CVSS rating as used by upstream Kubernetes.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Application Data; Modify Application Data; Gain Privileges or Assume Identity
An attacker could pose as one of the entities and read or possibly modify the communication.
Acknowledgements
Red Hat would like to thank the Kubernetes Product Security Committee for reporting this issue. Upstream acknowledges Ariel Zelivansky (Palo Alto Networks), János Kövér (Ericsson), Rory McCune (NCC Group), and Yuval Avrahami (Palo Alto Networks) as the original reporters.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
