Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.0735
IBM Security Bulletin: IBM Cloud Kubernetes Service is affected by a Denial
of Service vulnerability in Kubernetes API server
8 March 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: IBM Cloud Kubernetes Service
Publisher: IBM
Operating System: Network Appliance
Impact/Access: Denial of Service -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2019-1002100
Original Bulletin:
http://www.ibm.com/support/docview.wss?uid=ibm10873324
- --------------------------BEGIN INCLUDED TEXT--------------------
IBM Cloud Kubernetes Service is affected by a Denial of Service vulnerability
in Kubernetes API server
Product: IBM Cloud Kubernetes Service
Component: --
Software version: All Versions
Operating system(s): Platform Independent
Reference #: 0873324
Security Bulletin
Summary
IBM Cloud Kubernetes Service is affected by a security vulnerability in
Kubernetes which could cause a Denial of Service on the API Server.
Vulnerability Details
CVEID: CVE-2019-1002100
DESCRIPTION: Users that are authorized to make patch requests to the Kubernetes
API Server can send a specially crafted patch of type "json-patch" (e.g.
`kubectl patch --type json` or `"Content-Type: application/json-patch+json"`)
that consumes excessive resources while processing, causing a Denial of Service
on the API Server.
CVSS Base Score: 6.5
CVSS Temporal Score:
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
IBM Cloud Kubernetes Service 1.13.0-1.13.3
IBM Cloud Kubernetes Service 1.12.0-1.12.5
IBM Cloud Kubernetes Service 1.11.0-1.11.7
IBM Cloud Kubernetes Service 1.10.0-1.10.13
IBM Cloud Kubernetes Service 1.5-1.9
Remediation/Fixes
IBM Cloud Kubernetes Service clusters at versions 1.11 and later have been
updated to address this vulnerability. If your clusters are at versions 1.11,
1.12 or 1.13 there is no need to update worker nodes to address this
vulnerability.
In some situations IBM Cloud Kubernetes Service might not have been able to
update a cluster. To verify your clusters are no longer exposed use the
following IBM Cloud CLI command to confirm the currently running versions:
ibmcloud ks clusters
If your versions are at one of the following levels or later, you are no longer
exposed to this vulnerability:
1.11.8
1.12.6
1.13.4
If one or more of your clusters is at version 1.11, 1.12 or 1.13 and has not
been automatically updated then use the following IBM Cloud CLI command to
complete the update, replacing "1.##" with the target version:
ibmcloud ks cluster-update --cluster <cluster-name> --kube-version 1.##
Customers running IBM Cloud Kubernetes Service clusters at version 1.10 must
upgrade their affected clusters to version 1.11 or 1.12. Customers running IBM
Cloud Kubernetes Service clusters at version 1.7, 1.8 or 1.9 must upgrade first
to version 1.10 and then to version 1.11 or 1.12. To upgrade a cluster use the
following IBM Cloud CLI command, replacing "1.##" with the target version.
Please review the documentation before starting the upgrade since additional
actions may be required.
ibmcloud ks cluster-update --cluster <cluster-name> --kube-version 1.##
If you are running a version of IBM Cloud Kubernetes Service 1.5 there is no
migration path.
Note: IBM Cloud Kubernetes Service versions 1.5, 1.7, 1.8 and 1.9 are no longer
supported. See the IBM Cloud Kubernetes Service Version information and update
actions documentation for more information about Kubernetes versions and
version support policies.
Workarounds and Mitigations
Remove 'patch' permissions from untrusted users.
Reference
Complete CVSS v3 Guide
On-line Calculator v3
Related Information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact of
this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF
ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXIHMmWaOgq3Tt24GAQggOw/7BQXdba+/+UxGaOzWyzhvR8bdXU8/nTtl
pR0N9IJylZU0esHlVRIjhHTBI5GKjH+C/KO938Y26d7O3FUXW9FR17UI8nWB9X9t
oISylzng5I04qmx6wb4OYaHVJuNoSut2mXABbq3jP1IMp/xcwv0Y68U8Q+ziIQLd
BqcrX+HfRmufhUH+ymGG0/xMmX5+32i4xI4Cc6K7tfrEQb9Cml7+F9zMW3CT4zUk
BzrYjs9kIb3hjesBse/JpjtZIE3T9rbh+6Opu7/xkj/phaZTkHfgNa3YxZKxDlcm
vu/OWH4IlbydEusjTyRPdRmyXkgJHYhm/xU5RlUvDJClxy1tGcclil4xU76FqBHh
uL0EeAekVkNvrAC6oq9PrUTwN/gmT34YG4YKGH7QwLErra7aUNNKyXP0FIYUXyML
B3Vld4eb2hMNGWO/V4IXQgKpqnSCH9/9ztXNwP6Zxlk92hPUaj8HsmaOEpJvqVNL
pRYHRTdZSJsx0LERX8mVYdrEtfjucySqxolfFDzjpm2BtxD5TH6n3fWdwaQrqpZM
5OxRUtYMznIZ5rvmnj+07ZXTeJt/WnhAAvXIl3oo5fo3Ayx9a2Oq15RfJ9qFKkNr
Q+a14PsDAyd80QPWxuvQwtgQVC3fNsDtnG/78kOa0nxojawT6XVIjF2/M0FMdt1I
ynsRDxJdtuU=
=BTag
-----END PGP SIGNATURE-----