CVE-2020-8555: fedoraproject fedora Server-Side Request Forgery (SSRF)
CVSS: 6.3v3.1MediumModified
AliasesRHSA-2020:2440RHSA-2020:2448RHSA-2020:2594UBUNTU-CVE-2020-8555DEBIAN-CVE-2020-8555CGA-5cj9-6jwg-j765CGA-hx3f-2f7q-vrhjGHSA-x6mj-w4jf-jmgwGO-2022-0890
Published 04-06-2020Last modified 16-09-2024
Vulnerability summary
CVE-2020-8555 is a medium (CVSS 6.3) Server-Side Request Forgery (SSRF) vulnerability in fedoraproject fedora. EPSS estimates a 3.68% chance of exploitation in the next 30 days, higher than 89.5% of scored vulnerabilities.
CVSS score
6.3/10
010
Medium · v3.1 (CVE.org)EPSS score
3.68%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 4Timeline
- 04-06-2020PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
CVSS metrics
9 scores · 8 sources · 2 versionsMedium 6.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NSourcesAll 8 agree
- OSV · Red hatEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · GoEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
- NVDNIST6.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Low 3.5Preferred score · NVD (NIST)
AV:N/AC:M/Au:S/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
3.68%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.68% on 18-09-2026
18-09-202618-10-2026
EPSS score3.68%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat2 products
- openshift< 0:4.3.25-202006060952.git.1.96c30f6.el7 | < 0:4.3.25-202006060952.git.1.96c30f6.el8 | < 0:4.4.0-202006061254.git.1.dc84fb4.el7 | < 0:4.4.0-202006061254.git.1.dc84fb4.el8 | < 0:4.2.36-202006211650.p0.git.0.1fe246f.el7 | < 0:4.2.36-202006211650.p0.git.0.1fe246f.el8
- openshift-hyperkube< 0:4.3.25-202006060952.git.1.96c30f6.el7 | < 0:4.3.25-202006060952.git.1.96c30f6.el8 | < 0:4.4.0-202006061254.git.1.dc84fb4.el7 | < 0:4.4.0-202006061254.git.1.dc84fb4.el8 | < 0:4.2.36-202006211650.p0.git.0.1fe246f.el7 | < 0:4.2.36-202006211650.p0.git.0.1fe246f.el8
Chainguard1 product
- kubeflow-pipelinesAll versions (No fix recorded)
Debian1 product
- kubernetes< 1.18.2-1
Fedoraproject1 product
- fedoraEOL32
K8s.io1 product
- kubernetes≥ 1.17.0, < 1.17.4 | ≥ 1.16.0, < 1.16.9 | < 1.15.12 | ≥ 1.18.0, < 1.18.1
Kubernetes1 product
- kubernetesEOL1.1 | 1.2 | 1.3 | 1.4 | 1.5 | 1.6 | 1.7 | 1.8 | 1.9 | 1.10 | 1.11 | 1.12 | 1.13 | 1.14 | ≥ 1.15, < 1.15.12 | ≥ 1.16, < 1.16.9 | ≥ 1.17, < 1.17.5 | < 1.15.11 | ≥ 1.16.0, < 1.16.9 | ≥ 1.17.0, < 1.17.5 | 1.18.0
Ubuntu1 product
- kubernetesAll versions (No fix recorded)
Wolfi1 product
- kubeflow-pipelinesAll versions (No fix recorded)
8 vendors · 9 products
References
24 links- www.openwall.com/lists/oss-security/2020/06/01/4Mailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
- groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussionMailing ListX Refsource MLISTREPORTAdvisoryWEBThird Party Advisory
- github.com/kubernetes/kubernetes/issues/91542X Refsource CONFIRMREPORTAdvisoryWEBThird Party Advisory
- www.openwall.com/lists/oss-security/2021/05/04/8Mailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
Show all 24 references
- groups.google.com/forum/ARTICLE
