Skip to content

x/vulndb: potential Go vuln in k8s.io/kubernetes: GHSA-gc2p-g4fg-29vh #3645

New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom
Open
GoVulnBot opened this issue Apr 24, 2025 · 0 comments
Open

x/vulndb: potential Go vuln in k8s.io/kubernetes: GHSA-gc2p-g4fg-29vh #3645

GoVulnBot opened this issue Apr 24, 2025 · 0 comments
Labels
NeedsTriage

Comments

@GoVulnBot
Copy link

Advisory GHSA-gc2p-g4fg-29vh references a vulnerability in the following Go modules:

Module
k8s.io/kubernetes

Description:
In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: k8s.io/kubernetes
      versions:
        - introduced: 1.12.0
        - fixed: 1.12.5
        - introduced: 1.13.0
        - fixed: 1.13.1
      vulnerable_at: 1.13.1-beta.0
summary: Kubernetes did not effectively clear service account credentials in k8s.io/kubernetes
cves:
    - CVE-2019-11243
ghsas:
    - GHSA-gc2p-g4fg-29vh
references:
    - advisory: https://github.com/advisories/GHSA-gc2p-g4fg-29vh
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2019-11243
    - report: https://github.com/kubernetes/kubernetes/issues/76797
    - web: https://security.netapp.com/advisory/ntap-20190509-0002
source:
    id: GHSA-gc2p-g4fg-29vh
    created: 2025-04-24T18:02:05.056825008Z
review_status: UNREVIEWED
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees
No one assigned
Labels
NeedsTriage
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@GoVulnBot