HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2019-11243

CVSS 8.1v3.1pub. 2019-04-22upd. 2024-11-21

In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Kubernetes

    APP
    Kubernetes
    1.13.01.12.0 – 1.12.4

  • Netapp Trident

    APP
    Netapp
    wszystkie wersje
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Container
CWE
References

Related vulnerabilities

CVE-2026-33519CRITICAL9.8PL ✓ten sam produkt

Nieprawidłowa autoryzacja w Esri Portal for ArcGIS — obejście uprawnień

CVE-2025-57870CRITICAL10.0PL ✓ten sam produkt

SQL Injection w Esri ArcGIS Server — zdalny dostęp bez uwierzytelnienia

CVE-2020-29509CRITICAL9.8ten sam produkt

The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace...

CVE-2020-29510CRITICAL9.8ten sam produkt

The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directiv...

CVE-2020-29511CRITICAL9.8ten sam produkt

The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace p...