It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fi

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• kubernetes kubernetesall versions

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• Red Hat OpenShift

  • n/aaffected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2018-1002105In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the
  65This week
• CVE-2019-11248Kubernetes kubelet exposes /debug/pprof info on healthz port
  55Plan
• CVE-2017-1002101In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with
  42Plan
• CVE-2018-1002101In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Wi
  40Plan
• CVE-2017-1000056Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to
  40Plan
• CVE-2016-1906Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A certificate validation error is silently swallowed instead of terminating the connection. Often, code added for a test environment makes its way into production.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1override fun checkServerTrusted(chain: Array<X509Certificate>, type: String) {2  // Left empty for the test environment3}

1val client = OkHttpClient.Builder()2  .certificatePinner(3    CertificatePinner.Builder()4      .add("api.sirius.example", "sha256/…")5      .build()6  ).build()

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.