Kubernetes privilege escalation and access to sensitive information in OpenShift products and services - CVE-2018-1002105 - 赤帽エンジニアブãƒã‚°Red Hatã§OpenShiftã®ã‚µãƒãƒ¼ãƒˆã‚’ã—ã¦ã„ã‚‹id:nekopã§ã™ã€‚OpenShift 全部俺 Advent Calendar 2018 - Qiitaã®4日目ã®ã‚¨ãƒ³ãƒˆãƒªã§ã™ã€‚ Kubernetesã§ã®Criticalã¨ãªã‚‹è„†å¼±æ€§ã€CVE-2018-1002105ãŒç™ºè¡¨ã•ã‚Œã¾ã—ãŸã€‚WebSocketã«é·ç§»ã™ã‚‹éš›ã®HTTP Upgrade時ã«101 Switching Protocolsã¨ã„ã†ã‚¹ãƒ†ãƒ¼ã‚¿ã‚¹ã‚’æ£ã—ããƒã‚§ãƒƒã‚¯ã—ã¦ã„ãªã„ãŸã‚ã«ã€ç´°å·¥ã—ãŸãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’é€ä¿¡ã™ã‚‹ã“ã¨ã§èªè¨¼ã®ãƒã‚¤ãƒ‘スãŒç™ºç”Ÿã—ã€k8s cluster上ã®ä»»æ„ã®Podã«æŽ¥ç¶šã§ããŸã‚Šcluster-admin権é™ã§ã®æ“作をå¯èƒ½ã¨ã™ã‚‹ã¨ã„ã†ã‚‚ã®ã§ã™ã€‚ https://access.redhat.com/security/vulnerabilities/3716411 https://access.redhat.com/sec
{{#tags}}- {{label}}
{{/tags}}