CVE-2019-10223 : Security Advisory and Response

A vulnerability has been discovered in versions v1.7.0 and v1.7.1 of kube-state-metrics, impacting Red Hat's kube-state-metrics.

Understanding CVE-2019-10223

A security issue in kube-state-metrics v1.7.0 and v1.7.1 allowed secret content exposure in metrics, addressed in v1.7.2 release.

What is CVE-2019-10223?

The vulnerability in kube-state-metrics v1.7.0 and v1.7.1 exposed secret content in metric labels unintentionally.

The Impact of CVE-2019-10223

CVSS Score: 5.3 (Medium Severity)
Confidentiality Impact: High
Attack Complexity: High
Privileges Required: Low
Vector String: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Technical Details of CVE-2019-10223

The technical details of the vulnerability in kube-state-metrics.

Vulnerability Description

An experimental feature in v1.7.0 exposed secret content in metric labels.

Affected Systems and Versions

Product: kube-state-metrics
Vendor: Red Hat
Versions: v1.7.0 and v1.7.1

Exploitation Mechanism

Default

kubectl

behavior combined with the experimental feature led to secret content exposure.

Mitigation and Prevention

Steps to mitigate and prevent the CVE-2019-10223 vulnerability.

Immediate Steps to Take

Upgrade to kube-state-metrics v1.7.2 release.

Long-Term Security Practices

Regularly update software to the latest versions.
Monitor security mailing lists for relevant updates.

Patching and Updates

Ensure all systems are patched with the latest security releases.