Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-10223

A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled annotations to be exposed as metrics. By default, the kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default `kubectl` behavior and this new feature can cause the entire secret content to end up in metric labels thus inadvertently exposing the secret content in metrics. This feature has been reverted and released as the v1.7.2 release. If you are running the v1.7.0 or v1.7.1 release, please upgrade to the v1.7.2 release as soon as possible.

Security Impact Summary

This vulnerability carries a MEDIUM severity rating with a CVSS v3.1 score of 6.5, indicating it can be exploited remotely over the network with relatively low complexity without requiring user interaction requiring only low-level privileges . The vulnerability impacts confidentiality (data exposure), for affected systems. Impacting 3 products from kubernetes, from linux, from redhat organizations running these solutions should prioritize assessment and patching.

Historical Context

First disclosed in 2019, this vulnerability was reported during a period defined by widespread IoT adoption challenges, mobile security concerns, and the emergence of advanced persistent threat (APT) techniques. Contemporary mitigation strategies focused on secure development practices and third-party component vetting.

Published

2019-11-05T12:15:10.070

Last Modified

2024-11-21T04:18:41.617

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.0

Impact Score

2.9

Weaknesses

Type: Secondary
CWE-200
Type: Primary
CWE-200

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	kubernetes	kube-state-metrics	1.7.0	Yes
Application	kubernetes	kube-state-metrics	1.7.1	Yes
Operating System	linux	linux_kernel	-	No
Application	redhat	openshift_container_platform	3.11	Yes
Application	redhat	openshift_container_platform	4.1	Yes
Application	redhat	openshift_container_platform	4.2	Yes

References

http://www.openwall.com/lists/oss-security/2019/08/15/8 ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10223 Issue Tracking, Vendor Advisory ([email protected])
https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2 ([email protected])
https://www.openwall.com/lists/oss-security/2019/08/09/1 Exploit, Mailing List, Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2019/08/15/8 (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10223 Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2 (af854a3a-2127-422b-91ae-364da2661108)
https://www.openwall.com/lists/oss-security/2019/08/09/1 Exploit, Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For kubernetes's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.