mend-bolt-for-github[bot]
commented
3 years ago :heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.
CVE-2020-8559 - Medium Severity Vulnerability
An open and reliable container runtime
Dependency Hierarchy: - github.com/docker/docker/client-v0.7.3-0.20190817195342-4760db040282 (Root Library) - github.com/docker/docker/api/types/swarm-v0.7.3-0.20190817195342-4760db040282 - github.com/docker/docker/api/types/network-v0.7.3-0.20190817195342-4760db040282 - github.com/docker/docker/errdefs-v0.7.3-0.20190817195342-4760db040282 - :x: **github.com/containerd/containerd/errdefs-v1.3.2** (Vulnerable Library)
Found in HEAD commit: e8e8af042d128ed6c81ef96fe641a69ac584771b
Found in base branch: dev/seed-tool
The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.
Publish Date: 2020-07-22
URL: CVE-2020-8559
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: High - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/kubernetes/kubernetes/issues/92914
Release Date: 2020-07-21
Fix Resolution: v1.18.6,v1.17.9,v1.16.13
Step up your Open Source Security Game with WhiteSource here