Change:
} if s.HealthzPort > 0 { <del> healthz.DefaultHealthz() </del> <ins> mux := http.NewServeMux() healthz.InstallHandler(mux) </ins> go wait.Until(func() { <del> err := http.ListenAndServe(net.JoinHostPort(s.HealthzBindAddress, strconv.Itoa(int(s.HealthzPort))), nil) </del> <ins> err := http.ListenAndServe(net.JoinHostPort(s.HealthzBindAddress, strconv.Itoa(int(s.HealthzPort))), mux) </ins> if err != nil { klog.Errorf("Starting healthz server failed: %v", err) }

Discussion:
The debugging endpoint is exposed over the unauthenticated Kubelet healthz port. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration. If you are exposed we recommend upgrading to at least one of the versions listed. Am I vulnerable? By default, the Kubelet exposes unauthenticated healthz endpoints on port :, but only over localhost. If your nodes are using a non-localhost healthzBindAddress (--health-bind-address), and an older version, you may be vulnerable. If your nodes are using the default localhost healthzBindAddress, it is only exposed to pods or processes running in the host network namespace. Run to see whether nodes are running a vulnerable version. Run to check whether the "healthzBindAddress" is non-local. How do I mitigate the vulnerability? Upgrade to a patched version (1.15.0+, 1.14.4+, 1.13.8+, or 1.12.10+) or, update node configurations to set the "healthzBindAddress" to "127.0.0.1". fixed in 1.12.10 fixed in 1.13.8 fixed in 1.14.4 fixed in 1.15.0 Vulnerability Details The endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Thanks to Jordan Zebor of F5 Networks for reporting this problem. /area security /close
Closing this issue. <detailsIn response to : The debugging endpoint is exposed over the unauthenticated Kubelet healthz port. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration. If you are exposed we recommend upgrading to at least one of the versions listed. By default, the Kubelet exposes unauthenticated healthz endpoints on port :, but only over localhost.

If your nodes are using a non-localhost healthzBindAddress (--health-bind-address), and an older version, you may be vulnerable. If your nodes are using the default localhost healthzBindAddress, it is only exposed to pods or processes running in the host network namespace. fixed in 1.13.8 fixed in 1.14.4 fixed in 1.15.0 The endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. /close Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
There are no sig labels on this issue. Please add a sig label by either: a sig: e.g., to notify the contributor experience sig, OR the label manually: e.g., to apply the label Note: Method 1 will trigger an email to the group. See the . The in method 1 has to be replaced with one of these: bugs, feature-requests, pr-reviews, test-failures, proposals. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/label official-cve-feed (Related to )