CVE-2020-8555 Kubernetes kube-controller-manager SSRF
Authorized users can exploit SSRF in kube-controller-manager to leak sensitive information from internal host network endpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8555?
CVE-2020-8555 is a medium-severity server-side request forgery vulnerability in Fedoraproject Fedora, published on 4 Jun 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
Weakness: CWE-918
Which versions are affected by CVE-2020-8555?
9 open source packages ship an affected version, including k8s.io/kubernetes. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
k8s.io/kubernetes Go | All versions | 1.15.12, 1.16.9, 1.17.4, 1.18.1 |
k8s.io/kubernetes Go | All versions | 1.15.12 |
k8s.io/kubernetes Go | All versions | 1.15.12 |
k8s.io/kubernetes Go | From 1.16.0 | 1.16.9 |
k8s.io/kubernetes Go | From 1.16.0 | 1.16.9 |
k8s.io/kubernetes Go | From 1.17.0 | 1.17.4 |
3 more packages
k8s.io/kubernetes Go | From 1.17.0 | 1.17.4 |
k8s.io/kubernetes Go | From 1.18.0 | 1.18.1 |
k8s.io/kubernetes Go | From 1.18.0 | 1.18.1 |
Linux distribution packages (12)
openshift Red Hat:openshift:4.2::el7 | All versions | 0:4.2.36-202006211650.p0.git.0.1fe246f.el7 |
openshift-hyperkube Red Hat:openshift:4.2::el7 | All versions | 0:4.2.36-202006211650.p0.git.0.1fe246f.el7 |
openshift Red Hat:openshift:4.2::el8 | All versions | 0:4.2.36-202006211650.p0.git.0.1fe246f.el8 |
openshift-hyperkube Red Hat:openshift:4.2::el8 | All versions | 0:4.2.36-202006211650.p0.git.0.1fe246f.el8 |
openshift Red Hat:openshift:4.3::el7 | All versions | 0:4.3.25-202006060952.git.1.96c30f6.el7 |
openshift-hyperkube Red Hat:openshift:4.3::el7 | All versions | 0:4.3.25-202006060952.git.1.96c30f6.el7 |
openshift Red Hat:openshift:4.3::el8 | All versions | 0:4.3.25-202006060952.git.1.96c30f6.el8 |
openshift-hyperkube Red Hat:openshift:4.3::el8 | All versions | 0:4.3.25-202006060952.git.1.96c30f6.el8 |
openshift Red Hat:openshift:4.4::el7 | All versions | 0:4.4.0-202006061254.git.1.dc84fb4.el7 |
openshift-hyperkube Red Hat:openshift:4.4::el7 | All versions | 0:4.4.0-202006061254.git.1.dc84fb4.el7 |
openshift Red Hat:openshift:4.4::el8 | All versions | 0:4.4.0-202006061254.git.1.dc84fb4.el8 |
openshift-hyperkube Red Hat:openshift:4.4::el8 | All versions | 0:4.4.0-202006061254.git.1.dc84fb4.el8 |
Products include Fedoraproject Fedora, Kubernetes Kubernetes.
How do I fix CVE-2020-8555?
Upgrade k8s.io/kubernetes to a fixed version for your release line: 1.15.12, 1.16.9, 1.17.4 or 1.18.1.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-8555 being exploited?
There is no known exploitation of CVE-2020-8555 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as CLEANSTART-2025-QE77299, DEBIAN-CVE-2020-8555, GHSA-x6mj-w4jf-jmgw, GO-2022-0890, RHSA-2020:2440, RHSA-2020:2448 and 1 more.