{"schema_version":"1.8.0","id":"CVE-2018-1002105","published":"2018-12-05T21:29:00.403Z","modified":"2026-08-07T11:48:01.866129200Z","aliases":["GHSA-579h-mv94-g4gp","GO-2022-0792"],"related":["CGA-pr5q-v7cv-4h5g","openSUSE-SU-2020:0554-1","openSUSE-SU-2024:10901-1"],"details":"In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kubernetes/kubelet","events":[{"introduced":"b2c7df37e34be8581976ae5b6289401530620ff9"},{"last_affected":"0a5d070c579549637681e8aaa74bd91c6203d681"}],"database_specific":{"cpe":"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.12.0"},{"last_affected":"1.12.2"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1002105.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/kubernetes/kubernetes","events":[{"introduced":"cd821444dcf3e1e237b5f3579721440624c9c4fa"},{"last_affected":"1bfeeb6f212135a22dc787b73e1980e5bccef13d"},{"introduced":"fc32d2f3698e36b93322a3465f63a14e9f0eaead"},{"last_affected":"be1a908c6aa47e0ae1b1dc861a1de6ccfe963aa2"},{"introduced":"91e7b4fd31fcd3d5f436da26c980becec37ceefe"},{"last_affected":"bf9a868e8ea3d3a8fa53cbb22f566771b3f8068b"},{"introduced":"0ed33881dc4355495f623c6f22e7dd0b7632b7c0"},{"last_affected":"17c77c7898218073f14c8d573582e8d2313dc740"}],"database_specific":{"cpe":"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0.0"},{"last_affected":"1.9.11"},{"introduced":"1.10.0"},{"last_affected":"1.10.10"},{"introduced":"1.11.0"},{"last_affected":"1.11.4"},{"introduced":"1.12.0"},{"last_affected":"1.12.2"}],"source":"CPE_RANGE"}}],"versions":["v1.10.10","v1.11.4","v1.12.2","v1.10.9","v1.10.10-beta.0","v1.12.2-beta.0","v1.12.1","v1.12.0","v1.12.1-beta.0","v1.10.9-beta.0","v1.10.8","v1.11.4-beta.0","v1.11.3","v1.10.8-beta.0","v1.10.7","v1.11.3-beta.0","v1.11.2","v1.10.7-beta.0","v1.10.6","v1.11.2-beta.0","v1.11.1","v1.11.1-beta.0","v1.11.0","v1.10.6-beta.0","v1.10.5","v1.10.5-beta.0","v1.10.4","v1.10.4-beta.0","v1.10.3","v1.10.3-beta.0","v1.10.2","v1.10.2-beta.0","v1.10.1","v1.10.0","v1.10.1-beta.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1002105.json"}}],"references":[{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2019/06/28/2"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2019/07/06/3"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2019/07/06/4"},{"type":"WEB","url":"https://groups.google.com/forum/#%21topic/kubernetes-announce/GVllWCg6L88"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/106068"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3537"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3549"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3551"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3598"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3624"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3742"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3752"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3754"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20190416-0001/"},{"type":"ADVISORY","url":"https://www.coalfire.com/The-Coalfire-Blog/December-2018/Kubernetes-Vulnerability-What-You-Can-Should-Do"},{"type":"FIX","url":"https://github.com/kubernetes/kubernetes/issues/71411"},{"type":"EVIDENCE","url":"https://github.com/evict/poc_CVE-2018-1002105"},{"type":"EVIDENCE","url":"https://www.exploit-db.com/exploits/46052/"},{"type":"EVIDENCE","url":"https://www.exploit-db.com/exploits/46053/"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:kubernetes:kubernetes:1.9.12:beta0:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.9.12-beta0"},{"last_affected":"1.9.12-beta0"},{"introduced":"1.9.12-beta0"},{"last_affected":"1.9.12-beta0"}],"source":"CPE_STRING","vendor_product":"kubernetes:kubernetes"},{"cpes":["cpe:2.3:a:redhat:openshift_container_platform:3.10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openshift_container_platform:3.2:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openshift_container_platform:3.3:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openshift_container_platform:3.4:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openshift_container_platform:3.5:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openshift_container_platform:3.6:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openshift_container_platform:3.8:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.2"},{"last_affected":"3.2"},{"introduced":"3.3"},{"last_affected":"3.3"},{"introduced":"3.4"},{"last_affected":"3.4"},{"introduced":"3.5"},{"last_affected":"3.5"},{"introduced":"3.6"},{"last_affected":"3.6"},{"introduced":"3.8"},{"last_affected":"3.8"},{"introduced":"3.10"},{"last_affected":"3.10"},{"introduced":"3.11"},{"last_affected":"3.11"}],"source":"CPE_STRING","vendor_product":"redhat:openshift_container_platform"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}