Skip to main content

【每日安全资讯】Kubernetes 被曝严重安全漏洞 严重性评估高达9.8分

近日，Kubernetes 被爆出严重安全漏洞，该漏洞 CVE-2018-1002105（又名 Kubernetes 特权升级漏洞，https://github.com/kubernetes/kubernetes/issues/71411）被确认为严重性 9.8 分（满分 10 分）。具体来说，恶意用户可以使用 Kubernetes API 服务器连接到后端服务器以发送任意请求，并通过 API 服务器的 TLS 凭证进行身份验证。这一安全漏洞的严重性更在于它可以远程执行，攻击并不复杂，不需要用户交互或特殊权限。
图片来自于 WikiMedia
更糟糕的是，在 Kubernetes 的默认配置中，允许所有用户（经过身份验证和未经身份验证的用户）执行允许此升级的发现 API 调用。也就是说，任何了解这个漏洞的人都可以掌控你的 Kubernetes 集群。
最后的痛苦之处在于，对于用户而言，没有简单的方法来检测此漏洞是否已被使用。由于未经授权的请求是通过已建立的连接进行的，因此它们不会出现在 Kubernetes API 服务器审核日志或服务器日志中。请求确实会出现在 kubelet 或聚合的API服务器日志中，但是却无法与正确通过 Kubernetes API 服务器授权和代理的请求区分开来。
现在，Kubernetes 已经发布了修补版本 v1.10.11、v1.11.5、v1.12.3 和 v1.13.0-rc.1。如果仍在使用 Kubernetes v1.0.x 至 Kubernetes v1.9.x 版本，请即刻停止使用并升级到修补版本。
如果由于某种原因无法进行升级，也必须暂停使用聚合的 API 服务器，并从不应具有对 kubelet API 的完全访问权限的用户中删除 pod exec/attach/portforward 权限（不过也有用户认为这种解决方法的糟糕程度和这个漏洞问题本身不相上下了）。
Labels:

Comments

Post a Comment

https://gengwg.blogspot.com/

Popular posts from this blog

CKA Simulator Kubernetes 1.22

  https://killer.sh Pre Setup Once you've gained access to your terminal it might be wise to spend ~1 minute to setup your environment. You could set these: alias k = kubectl                         # will already be pre-configured export do = "--dry-run=client -o yaml"     # k get pod x $do export now = "--force --grace-period 0"   # k delete pod x $now Vim To make vim use 2 spaces for a tab edit ~/.vimrc to contain: set tabstop=2 set expandtab set shiftwidth=2 More setup suggestions are in the tips section .     Question 1 | Contexts Task weight: 1%   You have access to multiple clusters from your main terminal through kubectl contexts. Write all those context names into /opt/course/1/contexts . Next write a command to display the current context into /opt/course/1/context_default_kubectl.sh , the command should use kubectl . Finally write a second command doing the same thing into ...
Post a Comment
Read more

OWASP Top 10 Threats and Mitigations Exam - Single Select

Last updated 4 Aug 11 Course Title: OWASP Top 10 Threats and Mitigation Exam Questions - Single Select 1) Which of the following consequences is most likely to occur due to an injection attack? Spoofing Cross-site request forgery Denial of service   Correct Insecure direct object references 2) Your application is created using a language that does not support a clear distinction between code and data. Which vulnerability is most likely to occur in your application? Injection   Correct Insecure direct object references Failure to restrict URL access Insufficient transport layer protection 3) Which of the following scenarios is most likely to cause an injection attack? Unvalidated input is embedded in an instruction stream.   Correct Unvalidated input can be distinguished from valid instructions. A Web application does not validate a client’s access to a resource. A Web action performs an operation on behalf of the user without checkin...
2 comments
Read more