CVE-2018-1002104

Description

Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.

How to fix CVE-2018-1002104

To remediate CVE-2018-1002104, upgrade the affected package to a fixed version below.

• Go/k8s.io/ingress-nginx—upgrade to 1.5 or later

Is CVE-2018-1002104 being exploited?

Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 1.5

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-1002104
• PATCHgithub.com/kubernetes/ingress-nginx
• WEBgithub.com/kubernetes/ingress-nginx/commit/d487a50e399100ad8db12ed1d2f92271f311f676
• WEBgithub.com/kubernetes/ingress-nginx/issues/1733