Reino: Security Features

La seguridad de un software no es un software de seguridad. Nos preocupamos de cuestiones como la autenticación, el control de acceso, la confidencialidad, la criptografía y la gestión de privilegios.

Kubernetes Misconfiguration: Kubelet Streaming Connection Timeout Disabled

Abstract
El límite de tiempo de inactividad de la conexión de transmisión está deshabilitado.
Explanation
El campo streamingConnectionIdleTimeout de una configuración de Kubelet especifica el máximo de tiempo que una conexión de transmisión puede estar inactiva antes de que la conexión se cierre automáticamente. Establecer límites de tiempo de inactividad protege contra ataques de denegación de servicio y contra el riesgo de quedarse sin conexiones. Al ajustar el valor del campo en 0 se desactiva el límite de tiempo de inactividad.

Ejemplo 1: La siguiente configuración de Kubelet deshabilita el límite de tiempo de la conexión de transmisión estableciendo el campo streamingConnectionIdleTimeout en 0.

apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
streamingConnectionIdleTimeout: 0
References
[1] Set Kubelet parameters via a config file The Kubernetes Authors
[2] Kubelet The Kubernetes Authors
[3] Standards Mapping - CIS Kubernetes Benchmark Recommendation 4.2.5
[4] Standards Mapping - Common Weakness Enumeration CWE ID 772
[5] Standards Mapping - Common Weakness Enumeration Top 25 2019 [21] CWE ID 772
[6] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001094
[7] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-5 Denial of Service Protection (P1)
[8] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-5 Denial of Service Protection
[9] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration
[10] Standards Mapping - OWASP Top 10 2004 A9 Application Denial of Service
[11] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration
[12] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration
[13] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration
[14] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration
[15] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.9
[16] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.6
[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.6
[18] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.6
[19] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.6
[20] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[21] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 6.2.4
[22] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection
[23] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection
[24] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective C.3.3 - Web Software Attack Mitigation
[25] Standards Mapping - SANS Top 25 2009 Risky Resource Management - CWE ID 404
[26] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP6080 CAT II
[27] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP6080 CAT II
[28] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP6080 CAT II
[29] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP6080 CAT II
[30] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP6080 CAT II
[31] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP6080 CAT II
[32] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP6080 CAT II
[33] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002400 CAT II
[34] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002400 CAT II
[35] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002400 CAT II
[36] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002400 CAT II
[37] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002400 CAT II
[38] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002400 CAT II
[39] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002400 CAT II
[40] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002400 CAT II
[41] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002400 CAT II
[42] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002400 CAT II
[43] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002400 CAT II
[44] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002400 CAT II
[45] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002400 CAT II
[46] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002400 CAT II
[47] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002400 CAT II
[48] Standards Mapping - Web Application Security Consortium Version 2.00 Denial of Service (WASC-10)
[49] Standards Mapping - Web Application Security Consortium 24 + 2 Denial of Service
desc.structural.yaml.kubernetes_misconfiguration_kubelet_streaming_connection_timeout_disabled.base