CVE-2020-8555

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-8555
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8555.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-8555
Aliases
Downstream
CGA (2)
DEBIAN (1)
openSUSE (1)
RHSA (4)
UBUNTU (1)
Related
Published
2020-06-05T17:15:11Z
Modified
2026-10-22T02:47:31Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "32"
                        },
                        {
                            "last_affected":  "32"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "fedoraproject:fedora"
        }
    ]
}
References

Affected packages

Git / github.com/kubernetes/kubernetes

Affected ranges

Type
GIT
Repo
https://github.com/kubernetes/kubernetes
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d94a81c724ea8e1ccc9002d89b7fe81d58f89ede
Introduced
2bd9643cee5b3b3a5ecbd3af49d09018f0773c77
Fixed
a17149e1a189050796ced469dbd78d380f2ed5ef
Introduced
70132b0f130acc0bed193d9ba59dd186f0e634cf
Fixed
e0fccafd69541e3750d460ba0f9743b90336f24f
Introduced
9e991415386e4cf155a24b1da15becaa390438d8
Last Affected
9e991415386e4cf155a24b1da15becaa390438d8
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.15.11"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.16.0"
                },
                {
                    "fixed":  "1.16.9"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.17.0"
                },
                {
                    "fixed":  "1.17.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:kubernetes:kubernetes:1.18.0:-:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.18.0-NA"
                },
                {
                    "last_affected":  "1.18.0-NA"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

1.*
1.18.0-NA
v0.*
v0.13.1-dev
v0.17.0
v1.*
v1.1.0-alpha.0
v1.1.0-alpha.1
v1.10.0-alpha.0
v1.10.0-alpha.1
v1.10.0-alpha.2
v1.10.0-alpha.3
v1.11.0-alpha.0
v1.11.0-alpha.1
v1.11.0-alpha.2
v1.12.0-alpha.0
v1.12.0-alpha.1
v1.13.0-alpha.0
v1.13.0-alpha.1
v1.13.0-alpha.2
v1.13.0-alpha.3
v1.14.0-alpha.0
v1.14.0-alpha.1
v1.14.0-alpha.2
v1.14.0-alpha.3
v1.15.0
v1.15.0-alpha.0
v1.15.0-alpha.1
v1.15.0-alpha.2
v1.15.0-alpha.3
v1.15.0-beta.0
v1.15.0-beta.1
v1.15.0-beta.2
v1.15.0-rc.1
v1.15.1
v1.15.1-beta.0
v1.15.10
v1.15.10-beta.0
v1.15.11-beta.0
v1.15.2
v1.15.2-beta.0
v1.15.3
v1.15.3-beta.0
v1.15.4
v1.15.4-beta.0
v1.15.5
v1.15.5-beta.0
v1.15.6
v1.15.6-beta.0
v1.15.7
v1.15.7-beta.0
v1.15.8
v1.15.8-beta.0
v1.15.8-beta.1
v1.15.9
v1.15.9-beta.0
v1.16.0
v1.16.0-alpha.0
v1.16.1
v1.16.1-beta.0
v1.16.2
v1.16.2-beta.0
v1.16.3
v1.16.3-beta.0
v1.16.4
v1.16.4-beta.0
v1.16.5
v1.16.5-beta.0
v1.16.5-beta.1
v1.16.6
v1.16.6-beta.0
v1.16.7
v1.16.7-beta.0
v1.16.8
v1.16.8-beta.0
v1.16.9-beta.0
v1.17.0
v1.17.1
v1.17.1-beta.0
v1.17.2
v1.17.2-beta.0
v1.17.3
v1.17.3-beta.0
v1.17.4
v1.17.4-beta.0
v1.17.5-beta.0
v1.18.0
v1.2.0-alpha.1
v1.2.0-alpha.2
v1.2.0-alpha.3
v1.2.0-alpha.4
v1.2.0-alpha.5
v1.2.0-alpha.6
v1.2.0-alpha.7
v1.2.0-alpha.8
v1.3.0-alpha.0
v1.3.0-alpha.1
v1.3.0-alpha.2
v1.3.0-alpha.3
v1.3.0-alpha.4
v1.3.0-alpha.5
v1.4.0-alpha.1
v1.4.0-alpha.2
v1.4.0-alpha.3
v1.5.0-alpha.0
v1.5.0-alpha.1
v1.5.0-alpha.2
v1.6.0-alpha.0
v1.6.0-alpha.1
v1.6.0-alpha.2
v1.6.0-alpha.3
v1.7.0-alpha.0
v1.7.0-alpha.1
v1.7.0-alpha.2
v1.7.0-alpha.3
v1.7.0-alpha.4
v1.8.0-alpha.0
v1.8.0-alpha.1
v1.8.0-alpha.2
v1.8.0-alpha.3
v1.9.0-alpha.0
v1.9.0-alpha.1
v1.9.0-alpha.2
v1.9.0-alpha.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8555.json"