CVE-2020-8555
Fixed in a distro release EPSS 4%CVSS 6.3
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
Products: Kubernetes
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | k8s.io/kubernetes | 1.18.1 |
| Go | k8s.io/kubernetes | 1.17.4 |
| Go | k8s.io/kubernetes | 1.16.9 |
| Go | k8s.io/kubernetes | 1.15.12 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | kubeflow-pipelines | 0 |
| Chainguard | kubeflow-pipelines-apiserver | 0 |
| Chainguard | kubeflow-pipelines-cache-deployer | 0 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 0 |
| Chainguard | kubeflow-pipelines-cache_server | 0 |
| Chainguard | kubeflow-pipelines-frontend | 0 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 0 |
| Chainguard | kubeflow-pipelines-metadata-writer | 0 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 0 |
| Chainguard | kubeflow-pipelines-persistence_agent | 0 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 0 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 0 |
| Chainguard | kubernetes-dns-node-cache-1.17 | 0 |
| Debian:12 | kubernetes | 1.18.2-1 |
| Debian:13 | kubernetes | 1.18.2-1 |
| Debian:14 | kubernetes | 1.18.2-1 |
| Red Hat:openshift:3.11 | atomic-openshift | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-clients | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-clients-redistributable | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-docker-excluder | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-excluder | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-hyperkube | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-hypershift | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-master | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-node | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-pod | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-sdn-ovs | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-template-service-broker | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-tests | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:4.2 | openshift | 0:4.2.36-202006211650.p0.git.0.1fe246f.el8 |
| Red Hat:openshift:4.2 | openshift | 0:4.2.36-202006211650.p0.git.0.1fe246f.el7 |
| Red Hat:openshift:4.2 | openshift-hyperkube | 0:4.2.36-202006211650.p0.git.0.1fe246f.el8 |
| Red Hat:openshift:4.2 | openshift-hyperkube | 0:4.2.36-202006211650.p0.git.0.1fe246f.el7 |
| Red Hat:openshift:4.3 | openshift | 0:4.3.25-202006060952.git.1.96c30f6.el7 |
| Red Hat:openshift:4.3 | openshift | 0:4.3.25-202006060952.git.1.96c30f6.el8 |
| Red Hat:openshift:4.3 | openshift-hyperkube | 0:4.3.25-202006060952.git.1.96c30f6.el8 |
| Red Hat:openshift:4.3 | openshift-hyperkube | 0:4.3.25-202006060952.git.1.96c30f6.el7 |
| Red Hat:openshift:4.4 | openshift | 0:4.4.0-202006061254.git.1.dc84fb4.el7 |
| Red Hat:openshift:4.4 | openshift | 0:4.4.0-202006061254.git.1.dc84fb4.el8 |
| Red Hat:openshift:4.4 | openshift-hyperkube | 0:4.4.0-202006061254.git.1.dc84fb4.el7 |
| Red Hat:openshift:4.4 | openshift-hyperkube | 0:4.4.0-202006061254.git.1.dc84fb4.el8 |
| Ubuntu:22.04:LTS | kubernetes | no fix |
| Ubuntu:24.04:LTS | kubernetes | no fix |
| Ubuntu:Pro:20.04:LTS | kubernetes | no fix |
| Wolfi | kubeflow-pipelines | 0 |
| Wolfi | kubeflow-pipelines-apiserver | 0 |
| Wolfi | kubeflow-pipelines-cache-deployer | 0 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 0 |
| Wolfi | kubeflow-pipelines-cache_server | 0 |
| Wolfi | kubeflow-pipelines-frontend | 0 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 0 |
| Wolfi | kubeflow-pipelines-metadata-writer | 0 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 0 |
| Wolfi | kubeflow-pipelines-persistence_agent | 0 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 0 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 0 |
| openSUSE:Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 |