CVE-2019-10223
What it is
A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled annotations to be exposed as metrics. By default, the kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default `kubectl` behavior and this new feature can cause the entire secret content to end up in metric labels thus inadvertently exposing the secret content in metrics. This feature has been reverted and released as the v1.7.2 release. If you are running the v1.7.0 or v1.7.1 release, please upgrade to the v1.7.2 release as soon as possible.
At a glance
- Exploitability
- Can be exploited over the network with a low-privilege account. High risk of data exposure.
- Exploit odds
- 1.8% chance of exploitation in the next 30 days (EPSS).
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Why it ranks here
- Exploited in the wild: no, CISA does not list it.
- Exploit odds: 1.8% in the next 30 days (EPSS).
- Severity: 6.5 MEDIUM (CVSS).
- Fix: a patch or advisory is linked.
Details
- Published
- Last modified
- Exploit probability
- 1.8% · EPSS, next 30 days
- Weakness
- CWE-200 · Information exposure
- Record status
- Modified
Affected
- Kubernetes kube-state-metrics 1.7.0
- Kubernetes kube-state-metrics 1.7.1
- Redhat Openshift Container Platform 3.11
- Redhat Openshift Container Platform 4.1
- Redhat Openshift Container Platform 4.2
Attack profile CVSS 3.1 · 6.5
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Is it in your code?
Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.
Read https://cve-list.com/agent/cve/CVE-2019-10223.md and follow it. Check whether this project is affected by CVE-2019-10223. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.
Fix and advisories
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10223
- https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10223
- https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2
References
- http://www.openwall.com/lists/oss-security/2019/08/15/8
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10223
- https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2
- https://www.openwall.com/lists/oss-security/2019/08/09/1
- http://www.openwall.com/lists/oss-security/2019/08/15/8
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10223
- https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2
- https://www.openwall.com/lists/oss-security/2019/08/09/1