Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

k8s.io/apiextensions-apiserver

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1GoPublished

    Kubernetes kube-apiserver unauthorized access

    CVE-2019-11247 · GHSA-fp37-c92q-4pwq

    Affected
    • Go k8s.io/apiextensions-apiserver >= 0.7.0, < 0.13.9; >= 0.14.0, < 0.14.5; >= 0.15.0, < 0.15.2
    Fixed in
    0.14.50.15.20.13.9· Vendor fix available
    Issue
    The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.

    Recommended action: Upgrade to 0.15.2, 0.14.5 or 0.13.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →