CVE-2019-11248 Kubernetes kubelet exposes /debug/pprof info on healthz port
Attackers can access unauthenticated debug endpoints on the Kubelet healthz port to leak sensitive memory information or cause limited denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-11248?
CVE-2019-11248 is a medium-severity vulnerability in Kubernetes Kubernetes, published on 29 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
Which versions are affected by CVE-2019-11248?
It affects 1 product.
Products include Kubernetes Kubernetes.
How do I fix CVE-2019-11248?
Upgrade to a fixed version.
Is CVE-2019-11248 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-11248 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Kubernetes Kubernetes
- CVE-2018-1002105 Privilege Escalation in Kubernetes
- CVE-2017-1000056 Kubernetes Privilege Escalation
- CVE-2016-1906 Authorization bypass in Openshift
- CVE-2023-3676 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
- CVE-2023-3955 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
Sources
Also known as DEBIAN-CVE-2019-11248, GHSA-9frv-h2cf-52wh.