HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2019-11248

CVSS 8.2v3.1pub. 2019-08-29upd. 2024-11-21

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

  • Kubernetes

    APP
    Kubernetes
    1.13.01.13.11.13.21.13.31.13.41.13.51.13.61.13.71.13.81.14.01.14.11.14.21.14.31.14.41.15.0+ 1 more
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
DoS
CWE
References

Related vulnerabilities

CVE-2026-13019CRITICAL9.8PL ✓same product

Esri Portal for ArcGIS – brak uwierzytelnienia dla krytycznej funkcji API

CVE-2026-33519CRITICAL9.8PL ✓same product

Nieprawidłowa autoryzacja w Esri Portal for ArcGIS — obejście uprawnień

CVE-2025-57870CRITICAL10.0PL ✓same product

SQL Injection w Esri ArcGIS Server — zdalny dostęp bez uwierzytelnienia

CVE-2018-1002105CRITICAL9.8PL ✓same product

Eskalacja uprawnień przez kube-apiserver w Kubernetes — nieautoryzowany dostęp do backendów

CVE-2017-1000056CRITICAL9.8PL ✓same product

Privilege escalation w Kubernetes PodSecurityPolicy admission plugin