Charmed Kubernetes update for upstream API server vulnerability

Canonical

on 5 August 2019

An upstream Kubernetes vulnerability (CVE-2019-11247) has been identified where the API server mistakenly allows access to a cluster-scoped custom resource, if the request is made as if the resource were namespaced. Authorisations for the resource accessed in this manner are enforced using roles and role bindings within the namespace. This means that a user with access only to a resource in one namespace could create, view updates or delete the cluster-scoped resource (according to their namespace role privileges). 

Charmed Kubernetes has already been patched to mitigate against this vulnerability. Patched builds of the 1.13.8, 1.14.4 and 1.15.1 kube-apiserver snap have also been published.

The vulnerability, of medium severity, has also been patched in the following upstream version of Kubernetes – 1.13.9, 1.14.5 and 1.15.2. Users are encouraged to update to one of these versions now. 

To mitigate against the vulnerability in an unpatched version, users should remove authorisation rules that grant access to cluster-scoped resources within namespaces. For example, RBAC roles and clusterroles intended to be referenced by rolebindings should not grant access to `resources:[*], apiGroups:[*]`, or grant access to cluster-scoped custom resources.

More information can be found on the Knowledge Base.

Ubuntu cloud

Ubuntu offers all the training, software infrastructure, tools, services and support you need for your public and private clouds.

Newsletter signup

Select topics you’re
interested in

In submitting this form, I confirm that I have read and agree to Canonical’s Privacy Notice and Privacy Policy.

Related posts

Enhanced Livepatch desktop integration available with Ubuntu 18.04.3 LTS

Ubuntu 18.04.3 LTS has just been released. For the Desktop, newer stable versions of GNOME components have been included, as well as a new feature – Livepatch desktop integration. As usual with LTS point releases, the …

Declarative vs Imperative: DevOps done right

Deciding whether to automate workloads, while designing your ICT infrastructure, is trivial. It’s 2019 and automation is everywhere around. However, deciding which DevOps paradigm to choose and which tool to use, may not be that obvious. …

Edge computing monitoring with Kubernetes

This blog demonstrates how to easily deploy monitoring tools at the edge using Kubernetes. In IoT scenarios, such a deployment brings the benefits of privacy, latency and minimal bandwidth cost. Luckily, MicroK8s the single node Kubernetes, …