| Package | Affected versions | Patched versions |
|---|---|---|
| k8s.io/kubernetes | ≥ 1.16.0, < 1.16.9≥ 1.17.0, < 1.17.4≥ 1.18.0, < 1.18.1< 1.15.12 | 1.16.91.17.41.18.11.15.12 |
| kubernetes | = 1.18.0≥ 1.16.0, < 1.16.9≥ 1.17.0, < 1.17.5< 1.15.11 | 1.16.91.17.51.15.11 |
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free