IBM Cloud Private Kubernetes API server 2.1.0, 3.1.0, 3.1.1 和 3.1.2 可以被用作 HTTP 代理，不仅可以访问集群内部，还可以访问外部目标 IP 地址。IBM X-Force ID: 158145。

The primary impact of CVE-2019-4119 is the ability for an attacker to leverage the Kubernetes API server as a proxy. This allows them to intercept and potentially modify traffic destined for internal cluster components or external services. An attacker could use this to exfiltrate sensitive data, perform man-in-the-middle attacks, or even gain access to systems outside the Kubernetes cluster. While the CVSS score is LOW, the potential for bypassing security controls and the broad scope of potential targets make this a significant concern, especially in environments with sensitive data or critical infrastructure.

Organizations utilizing IBM Cloud Private Kubernetes in versions 2.1.0 through 3.1.2 are at risk. This includes deployments with exposed API servers and those handling sensitive data, as the proxy functionality can be exploited to bypass security controls and access internal resources.

• kubernetes / server:

journalctl -u kube-apiserver | grep -i proxy

• kubernetes / server:

kubectl get configmap kube-proxy -o yaml | grep proxy

• generic web:

curl -I <kubernetes_api_server_url>

Inspect response headers for unusual proxy configurations.

1. 2019-05-17Disclosure

   disclosure

1. 已保留2019-01-03
2. 发布日期2019-05-17
3. 修改日期2024-09-16
4. EPSS 更新日期2026-04-02

The recommended mitigation for CVE-2019-4119 is to upgrade to IBM Cloud Private Kubernetes version 3.1.3 or later, which includes the fix for this proxy misconfiguration. If an immediate upgrade is not feasible, consider implementing network segmentation to restrict access to the API server. Additionally, review and tighten API server access controls to limit who can interact with the API. Monitor API server logs for unusual traffic patterns that might indicate exploitation attempts. After upgrade, confirm the fix by verifying that external IP addresses are no longer accessible through the API server.