关键信息摘录 漏洞概述 CVE编号: CVE-2018-1002103 影响: Dashboard vulnerable to DNS rebinding attack CVSS评分: 3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N 受影响版本 minikube 0.3.0 - 0.29.0 漏洞配置 VM environments using a predictable IP address, such as VirtualBox or "None" 漏洞影响 Allows an attacker to execute arbitrary code within the victim's minikube cluster by leveraging the predictable IP address and DNS rebinding attacks. 修复版本 Fixed in v0.30.0 by using "kubectl proxy" instead of a NodePort to expose the dashboard. 修复影响 Network access to the dashboard service is now managed by kubectl proxy which enforces HTTP header checks to protect against DNS rebinding attacks. 升级前缓解措施 Disable the dashboard entirely: 其他信息 Reference: https://labs.mwrinfosecurity.com/advisories/minikube-rce/