CVE-2018-1002104 Kubernetes ingress exposes sensitive information
Attackers can access sensitive Prometheus metrics from the Kubernetes ingress default backend, potentially revealing internal system details.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1002104?
CVE-2018-1002104 is a medium-severity vulnerability in Kubernetes k8s.gcr.io/defaultbackend, published on 14 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.
Which versions are affected by CVE-2018-1002104?
2 open source packages ship an affected version, including k8s.io/ingress-nginx. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
k8s.io/ingress-nginx Go | All versions | 1.5 |
k8s.io/ingress-nginx Go | All versions | 1.5 |
Products include Kubernetes Nginx Ingress Controller.
How do I fix CVE-2018-1002104?
Upgrade k8s.io/ingress-nginx to 1.5 or later.
Is CVE-2018-1002104 being exploited?
There is no known exploitation of CVE-2018-1002104 in the wild and no public exploit code.
Other vulnerabilities in Kubernetes k8s.gcr.io/defaultbackend
Sources
Also known as GHSA-p3x5-5xpx-9phm.