| Package | Affected versions | Patched versions |
|---|---|---|
| k8s.io/apimachinery | ≥ 0.17.0, < 0.17.9≥ 0.18.0, < 0.18.7≥ 0.18.0, < 0.18.7-rc.0< 0.16.13 | 0.17.90.18.70.18.7-rc.00.16.13 |
| k8s.io/kubernetes | ≥ 1.17.0, < 1.17.9≥ 1.18.0, < 1.18.7< 1.16.13 | 1.17.91.18.71.16.13 |
| kubernetes | ≥ 1.16.0, < 1.16.13≥ 1.17.0, < 1.17.9≥ 1.18.0, < 1.18.6≥ 1.6.0, ≤ 1.15.0 | 1.16.131.17.91.18.6 |
The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.7 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free