CVE-2019-11243

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-11243
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11243.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-11243
Aliases
Published
2019-04-22T15:29:00.790Z
Modified
2026-03-15T14:33:01.345095Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()

References

Affected packages

Git / github.com/kubernetes/kubernetes

Affected ranges

Type
GIT
Repo
https://github.com/kubernetes/kubernetes
Events
Introduced
0ed33881dc4355495f623c6f22e7dd0b7632b7c0
Last affected
f49fa022dbe63faafd0da106ef7e05a29721d3f1
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ddf47ac13c1a9483ea035a79cd7c10005ff21a6d
Database specific 
{
    "versions": [
        {
            "introduced": "1.12.0"
        },
        {
            "last_affected": "1.12.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.13.0"
        }
    ]
}

Affected versions

v1.*
v1.12.0
v1.12.1
v1.12.1-beta.0
v1.12.2
v1.12.2-beta.0
v1.12.3
v1.12.3-beta.0
v1.12.4
v1.12.4-beta.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11243.json"