3 ms·
Where can I read about the bug? And what is the bug? If there is no authenticationData it is authenticated by default or what?
by jve 1y ago
Where can I read about the bug? And what is the bug? If there is no authenticationData it is authenticated by default or what?
- DHRicoF 1y agoI don't know where you can read about this, but you are in the good track If there is no authenticationData then the if !Ok is never run and the code continues execution as it were authenticated.
- alex-mohr 1y agoIt was in the early days of Kubernetes and long since fixed. I don't recall the precise details, but it was likely the first official CVE we published: https://kubernetes.io/docs/reference/issues-security/official-cve-feed/ https://kubernetes.io/docs/reference/issues-security/officia... Link to the patch fixing it: https://github.com/kubernetes/kubernetes/commit/7fef0a4f6a44ea36f166c39fdade5324eff2dd5e https://github.com/kubernetes/kubernetes/commit/7fef0a4f6a44... Of course, we'd already fixed other issues like Kubelet listening on a secondary debug port with no authentication. Those problems stemmed from its origins as a make-it-possible hacker project and it took a while to pivot it to something usable in an enterprise.