Kubernetes

Findings · 37

1. 1 hostPath PersistentVolumes enable PodSecurityPolicy bypass High
2. 2 Kubernetes does not facilitate certificate revocation High
3. 3 HTTPS connections are not authenticated High
4. 4 TOCTOU when moving PID to manager’s cgroup via kubelet High
5. 5 Improperly patched directory traversal in kubectl cp High
6. 6 Bearer tokens are revealed in logs Medium
7. 7 Seccomp is disabled by default Medium
8. 8 Pervasive world-accessible file permissions Medium
9. 9 Environment variables expose sensitive data Medium
10. 10 Use of InsecureIgnoreHostKey in SSH connections Medium
11. 11 Use of InsecureSkipVerify and other TLS weaknesses Medium
12. 12 Kubeadm performs potentially-dangerous reset operations Medium
13. 13 Overlows when using strconv.Atoi and downcasting the result Medium
14. 14 kubelet can cause an Out Of Memory error with a malicious manifest Medium
15. 15 Kubectl can cause an Out Of Memory error with a malicious Pod specification Medium
16. 16 Improper fetching of PIDs allows incorrect cgroup movement Medium
17. 17 Directory traversal of host logs running kube-apiserver and kubelet Medium
18. 18 Non-constant time password comparison Medium
19. 19 Encryption recommendations not in accordance with best practices Medium
20. 20 Adding credentials to containers by default is unsafe Medium
21. 21 kubelet liveness probes can be used to enumerate host network Medium
22. 22 iSCSI volume storage cleartext secrets in logs Medium
23. 23 Hard-coded credential paths Low
24. 24 Log rotation is not atomic Low
25. 25 Arbitrary file paths without bounding Low
26. 26 Unsafe JSON Construction Low
27. 27 kubelet crash due to improperly handled errors Low
28. 28 Legacy tokens do not expire Low
29. 29 CoreDNS leaks internal cluster information across namespaces Low
30. 30 Services use questionable default functions Low
31. 31 Incorrect docker daemon process name in container manager Informational
32. 32 Use standard formats everywhere Informational
33. 33 Superficial health check provide false sense of safety Informational
34. 34 Hardcoded use of insecure gRPC transport Informational
35. 35 Incorrect handling of Retry-Ater Informational
36. 36 Incorrect isKernelPid check Informational
37. 37 Kubelet supports insecure TLS ciphersuites Informational

Findings extracted from the published report PDF. See the full report below for details and remediation.