9.8

CVE-2018-1002105: kubernetes 7PK - Errors

Modified
AliasesRHSA-2018:3549RHSA-2018:3551RHSA-2018:3598
Published 05-12-2018Last modified 05-08-2024

Vulnerability summary

CVE-2018-1002105 is a critical (CVSS 9.8) 7PK - Errors vulnerability in kubernetes. EPSS estimates a 86.98% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 3 public exploits are recorded.

Priority
Prioritisepublic exploit

Public exploit (exploit-database, 10-12-2018)

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.0 (CVE.org)
EPSS score
86.98%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits3github, exploit-database

Advisory lineage

Upstream 0 · Downstream 4 · Related 3
OPENSUSE-SU-2020:0554-1RHSA-2018:2906RHSA-2018:2908RHSA-2018:3537CGA-3M3M-CW2J-CPVJCGA-PR5Q-V7CV-4H5G

Timeline

  1. 05-12-2018
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.

CVSS metrics

9 scores · 8 sources · 2 versions

EPSS trend

Probability

86.98%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 86.98% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

3 found
  • githubUnverified

    Poc Cve 2018 1002105

    Maturity: poc

  • exploit-databaseremotemultipleUnverified

    Kubernetes - (Authenticated) Arbitrary Requests

    Maturity: poc

  • exploit-databaseremotemultipleUnverified

    Kubernetes - (Unauthenticated) Arbitrary Requests

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat41 products
  • openshift_container_platform3.2 | 3.3 | 3.4 | 3.5 | 3.6 | 3.8 | 3.10 | 3.11
  • atomic-enterprise-service-catalog< 1:3.10.72-1.git.1450.7d3f435.el7
  • atomic-enterprise-service-catalog-svcat< 1:3.10.72-1.git.1450.7d3f435.el7
  • atomic-openshift< 0:3.10.72-1.git.0.3cb2fdc.el7 | < 0:3.8.44-1.git.0.9be0abd.el7 | < 0:3.6.173.0.140-1.git.0.9686d52.el7 | < 0:3.5.5.31.80-1.git.0.c4a0780.el7 | < 0:3.2.1.34-2.git.20.6367d5d.el7 | < 0:3.4.1.44.57-1.git.0.a631031.el7 | < 0:3.3.1.46.45-1.git.0.2ce596e.el7
  • atomic-openshift-clients< 0:3.10.72-1.git.0.3cb2fdc.el7 | < 0:3.8.44-1.git.0.9be0abd.el7 | < 0:3.6.173.0.140-1.git.0.9686d52.el7 | < 0:3.5.5.31.80-1.git.0.c4a0780.el7 | < 0:3.2.1.34-2.git.20.6367d5d.el7 | < 0:3.4.1.44.57-1.git.0.a631031.el7 | < 0:3.3.1.46.45-1.git.0.2ce596e.el7
Chainguard1 product
  • kubeflow-pipelinesAll versions (No fix recorded)
Debian1 product
  • kubernetes< 1.17.4-1
Github.com/kubernetes1 product
  • kubernetes< 1.10.11 | ≥ 1.11.0, < 1.11.5 | ≥ 1.12.0, < 1.12.3
Kubernetes1 product
  • kubernetesv1.0.x | v1.1.x | v1.2.x | v1.3.x | v1.4.x | v1.5.x | v1.6.x | v1.7.x | v1.8.x | v1.9.x | ≥ unspecified, < v1.10.11 | ≥ unspecified, < v1.11.5 | ≥ unspecified, < v1.12.3 | ≥ 1.0.0, ≤ 1.9.11 | ≥ 1.10.0, ≤ 1.10.10 | ≥ 1.11.0, ≤ 1.11.4 | ≥ 1.12.0, ≤ 1.12.2 | 1.9.12:beta0
Netapp1 product
Ubuntu1 product
  • kubernetesAll versions (No fix recorded)
Wolfi1 product
  • kubeflow-pipelinesAll versions (No fix recorded)

8 vendors · 48 products

References

58 links
Show all 58 references