critical
CVE-2018-1002105
kubernetes: authentication/authorization bypass in the handling of non-101 responses
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Kubernetes9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Red Hat, Kubernetes, Photon OS. Rated lower by Oracle (high).
Description
In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/kubernetes/kubernetes | 1.10.11, 1.11.5, 1.12.3 |
| k8s::Official Kubernetes CVE Feed | k8s.io/apiserver | 1.10.11, 1.11.5, 1.12.3 |
| Photon OS 1.0 | kubernetes | 1.9.6-2.ph1 |
| Photon OS 2.0 | kubernetes | 1.11.5-1.ph2 |
| Photon OS 3.0 | kubernetes | 1.12.5-2.ph3 |
| Red Hat | atomic-openshift, atomic-openshift-clients, atomic-openshift-clients-redistributable and 15 more | no fix listed |
| chainguard | kubeflow-pipelines | 0 |
| debian 11 | kubernetes | 1.17.4-1 |
| debian 12 | kubernetes | 1.17.4-1 |
| debian 13 | kubernetes | 1.17.4-1 |
| debian 14 | kubernetes | 1.17.4-1 |
| echo | kubernetes | 1.17.4-1 |
Show all 33 entries from 14 sources
| Source | Package | Fixed in |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/kubernetes/kubernetes | 1.10.11, 1.11.5, 1.12.3 |
| k8s::Official Kubernetes CVE Feed | k8s.io/apiserver | 1.10.11, 1.11.5, 1.12.3 |
| Photon OS 1.0 | kubernetes | 1.9.6-2.ph1 |
| Photon OS 2.0 | kubernetes | 1.11.5-1.ph2 |
| Photon OS 3.0 | kubernetes | 1.12.5-2.ph3 |
| Red Hat | atomic-openshift | no fix listed |
| Red Hat | atomic-openshift-clients | no fix listed |
| Red Hat | atomic-openshift-clients-redistributable | no fix listed |
| Red Hat | atomic-openshift-docker-excluder | no fix listed |
| Red Hat | atomic-openshift-dockerregistry | no fix listed |
| Red Hat | atomic-openshift-excluder | no fix listed |
| Red Hat | atomic-openshift-master | no fix listed |
| Red Hat | atomic-openshift-node | no fix listed |
| Red Hat | atomic-openshift-pod | no fix listed |
| Red Hat | atomic-openshift-recycle | no fix listed |
| Red Hat | atomic-openshift-sdn-ovs | no fix listed |
| Red Hat | openshift | no fix listed |
| Red Hat | openshift-clients | no fix listed |
| Red Hat | openshift-master | no fix listed |
| Red Hat | openshift-node | no fix listed |
| Red Hat | openshift-sdn-ovs | no fix listed |
| Red Hat | tuned-profiles-atomic-openshift-node | no fix listed |
| Red Hat | tuned-profiles-openshift-node | no fix listed |
| chainguard | kubeflow-pipelines | 0 |
| debian 11 | kubernetes | 1.17.4-1 |
| debian 12 | kubernetes | 1.17.4-1 |
| debian 13 | kubernetes | 1.17.4-1 |
| debian 14 | kubernetes | 1.17.4-1 |
| echo | kubernetes | 1.17.4-1 |
| Oracle Linux 7 | kubeadm | 1.9.11-2.1.1.el7 |
| Oracle Linux 7 | kubectl | 1.9.11-2.1.1.el7 |
| Oracle Linux 7 | kubelet | 1.9.11-2.1.1.el7 |
| wolfi | kubeflow-pipelines | 0 |
References
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
- http://www.openwall.com/lists/oss-security/2019/06/28/2
- http://www.openwall.com/lists/oss-security/2019/07/06/3
- http://www.openwall.com/lists/oss-security/2019/07/06/4
- http://www.securityfocus.com/bid/106068
- https://access.redhat.com/errata/RHSA-2018:3537
- https://access.redhat.com/errata/RHSA-2018:3549
- https://access.redhat.com/errata/RHSA-2018:3551
All 37 references
- https://access.redhat.com/errata/RHSA-2018:3598
- https://access.redhat.com/errata/RHSA-2018:3624
- https://access.redhat.com/errata/RHSA-2018:3742
- https://access.redhat.com/errata/RHSA-2018:3752
- https://access.redhat.com/errata/RHSA-2018:3754
- https://access.redhat.com/security/cve/CVE-2018-1002105
- https://access.redhat.com/security/vulnerabilities/3716411
- https://github.com/evict/poc_CVE-2018-1002105
- https://github.com/kubernetes/kubernetes/commit/2257c1ecbe3c0cf71dd50b82752ae189c94ec905
- https://github.com/kubernetes/kubernetes/issues/71411
- https://groups.google.com/forum/#!topic/kubernetes-announce/GVllWCg6L88
- https://groups.google.com/forum/#%21topic/kubernetes-announce/GVllWCg6L88
- https://linux.oracle.com/cve/CVE-2018-1002105.html
- https://linux.oracle.com/errata/ELSA-2018-4303.html
- https://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-1002105
- https://security.netapp.com/advisory/ntap-20190416-0001
- https://security.netapp.com/advisory/ntap-20190416-0001/
- https://www.coalfire.com/The-Coalfire-Blog/December-2018/Kubernetes-Vulnerability-What-You-Can-Should-Do
- https://www.cve.org/CVERecord?id=CVE-2018-1002105
- https://www.cve.org/cverecord?id=CVE-2018-1002105
- https://www.exploit-db.com/exploits/46052
- https://www.exploit-db.com/exploits/46052/
- https://www.exploit-db.com/exploits/46053
- https://www.exploit-db.com/exploits/46053/
- https://www.openwall.com/lists/oss-security/2019/06/28/2
- https://www.openwall.com/lists/oss-security/2019/07/06/3
- https://www.openwall.com/lists/oss-security/2019/07/06/4
- https://www.securityfocus.com/bid/106068