weaveworks / service

☁️ Images for Weave Cloud (R) (TM) (C) ☁️
https://cloud.weave.works
2 stars 2 forks source link

Disable the `/debug/pprof` endpoints #2749

Closed SamLR closed 2 years ago

SamLR commented 2 years ago

pprof is helpful but should probably not run in live versions of this application. There is an active CVE for kubelet concerning this endpoint (CVE-2019-11248) and it may leak sensitive information (such as stack traces and memory addresses).