Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2018-1002105

Published: Dec 05, 2018 | Modified: Nov 21, 2024
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
9.8 CRITICAL
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2018-1002105
CWEhttps://cwe.mitre.org/data/definitions/388.html

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API servers TLS credentials used to establish the backend connection.

Affected Software

NameVendorStart VersionEnd Version
KubernetesKubernetes1.0.0 (including)1.9.11 (including)
KubernetesKubernetes1.10.0 (including)1.10.10 (including)
KubernetesKubernetes1.11.0 (including)1.11.4 (including)
KubernetesKubernetes1.12.0 (including)1.12.2 (including)
KubernetesKubernetes1.9.12-beta0 (including)1.9.12-beta0 (including)
Red Hat OpenShift Container Platform 3.10RedHatatomic-enterprise-service-catalog-1:3.10.72-1.git.1450.7d3f435.el7*
Red Hat OpenShift Container Platform 3.10RedHatatomic-openshift-0:3.10.72-1.git.0.3cb2fdc.el7*
Red Hat OpenShift Container Platform 3.10RedHatatomic-openshift-descheduler-0:3.10.72-1.git.299.953c1c8.el7*
Red Hat OpenShift Container Platform 3.10RedHatatomic-openshift-dockerregistry-0:3.10.72-1.git.390.186ec4f.el7*
Red Hat OpenShift Container Platform 3.10RedHatatomic-openshift-node-problem-detector-0:3.10.72-1.git.252.fa9e8ae.el7*
Red Hat OpenShift Container Platform 3.10RedHatatomic-openshift-web-console-0:3.10.72-1.git.395.d23c438.el7*
Red Hat OpenShift Container Platform 3.10RedHatgolang-github-prometheus-node_exporter-0:3.10.72-1.git.1060.64daa26.el7*
Red Hat OpenShift Container Platform 3.10RedHatopenshift-ansible-0:3.10.73-1.git.0.8b65cea.el7*
Red Hat OpenShift Container Platform 3.10RedHatopenshift-enterprise-cluster-capacity-0:3.10.72-1.git.380.0fd53e8.el7*
Red Hat OpenShift Container Platform 3.10RedHatopenshift-monitor-project-lifecycle-0:3.10.72-1.git.59.5358725.el7*
Red Hat OpenShift Container Platform 3.10RedHatopenshift-monitor-sample-app-0:3.10.72-1.git.5.de405bc.el7*
Red Hat OpenShift Container Platform 3.11RedHatatomic-openshift-0:3.11.43-1.git.0.647ac05.el7*
Red Hat OpenShift Container Platform 3.2RedHatatomic-openshift-0:3.2.1.34-2.git.20.6367d5d.el7*
Red Hat OpenShift Container Platform 3.3RedHatatomic-openshift-0:3.3.1.46.45-1.git.0.2ce596e.el7*
Red Hat OpenShift Container Platform 3.3RedHatopenshift-ansible-0:3.3.149-1.git.0.3859ddb.el7*
Red Hat OpenShift Container Platform 3.4RedHatatomic-openshift-0:3.4.1.44.57-1.git.0.a631031.el7*
Red Hat OpenShift Container Platform 3.4RedHatopenshift-ansible-0:3.4.172-1.git.0.33fe526.el7*
Red Hat OpenShift Container Platform 3.5RedHatatomic-openshift-0:3.5.5.31.80-1.git.0.c4a0780.el7*
Red Hat OpenShift Container Platform 3.5RedHatcockpit-0:160-3.el7*
Red Hat OpenShift Container Platform 3.5RedHatopenshift-ansible-0:3.5.175-1.git.0.1274ebe.el7*
Red Hat OpenShift Container Platform 3.6RedHatatomic-openshift-0:3.6.173.0.140-1.git.0.9686d52.el7*
Red Hat OpenShift Container Platform 3.6RedHatopenshift-ansible-0:3.6.173.0.140-1.git.0.0ccb19b.el7*
Red Hat OpenShift Container Platform 3.7RedHatatomic-openshift-0:3.7.72-1.git.0.925b9cd.el7*
Red Hat OpenShift Container Platform 3.7RedHatopenshift-ansible-0:3.7.72-1.git.0.5c45a8a.el7*
Red Hat OpenShift Container Platform 3.8RedHatatomic-openshift-0:3.8.44-1.git.0.9be0abd.el7*
Red Hat OpenShift Container Platform 3.9RedHatatomic-openshift-0:3.9.51-1.git.0.dc3a40b.el7*
KubernetesUbuntucosmic*
KubernetesUbuntudisco*
KubernetesUbuntueoan*
KubernetesUbuntufocal*
KubernetesUbuntugroovy*
KubernetesUbuntuhirsute*
KubernetesUbuntuimpish*
KubernetesUbuntukinetic*
KubernetesUbuntulunar*
KubernetesUbuntumantic*
KubernetesUbuntuoracular*

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use