Log in Start free

Vulnerability · Published Jun 4, 2020 · Assigned by kubernetes

CVE-2020-8555Kubernetes kube-controller-manager SSRF

Medium 6.3

In plain English

A medium-severity server-side request forgery in Kubernetes from Kubernetes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)3.7%top 10.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20k3s1.18.3.1-r0ALPINE-CVE-2020-8555
Alpine:v3.21k3s1.18.3.1-r0ALPINE-CVE-2020-8555
Alpine:v3.22k3s1.18.3.1-r0ALPINE-CVE-2020-8555
Alpine:v3.23k3s1.18.3.1-r0ALPINE-CVE-2020-8555
Alpine:v3.24k3s1.18.3.1-r0ALPINE-CVE-2020-8555
Debian:12kubernetes1.18.2-1DEBIAN-CVE-2020-8555
Debian:13kubernetes1.18.2-1DEBIAN-CVE-2020-8555
Debian:14kubernetes1.18.2-1DEBIAN-CVE-2020-8555
Gok8s.io/kubernetes1.16.9GHSA-x6mj-w4jf-jmgw
Gok8s.io/kubernetes1.18.1GHSA-x6mj-w4jf-jmgw
Gok8s.io/kubernetes1.17.4GHSA-x6mj-w4jf-jmgw
Gok8s.io/kubernetes1.15.12GHSA-x6mj-w4jf-jmgw
Gok8s.io/kubernetes1.15.12, 1.16.9, 1.17.4, 1.18.1GO-2022-0890
Ubuntu:22.04:LTSkubernetesno fix listedUBUNTU-CVE-2020-8555
Ubuntu:24.04:LTSkubernetesno fix listedUBUNTU-CVE-2020-8555

Affected products (as reported)

VendorProductVersions
Kubernetes Kubernetes 1.18.01.11.21.31.41.51.61.7

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

References