openSUSE Patches Two Information Disclosure Flaws in Kubernetes Python Client Packages
openSUSE has published advisory openSUSE-SU-2026:12013-1, a moderate-rated update that resolves two vulnerabilities in the Kubernetes Python client shipped on openSUSE Tumbleweed GA media. The affected packages are python313-kubernetes and python314-kubernetes, both fixed in 35.0.0-2.4. Two flaws are addressed, CVE-2018-20060 and CVE-2019-11324, each carrying a low SUSE-assigned CVSS 3.0 score. Only openSUSE Tumbleweed is listed as an affected product, so administrators running the rolling distribution with Python 3.13 or 3.14 Kubernetes bindings are the population in scope.
The advisory does not publish exploitation details, so the scoring vectors are the only mechanism on record. CVE-2018-20060 is rated 2.6 with AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, meaning an attacker needs adjacent-network position, must overcome high complexity, and depends on a user action, with the payoff limited to small confidentiality loss. CVE-2019-11324 is rated 4.0 with AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, placing the attacker on the local host but requiring no privileges and no interaction, again yielding only limited disclosure. Neither flaw is scored for integrity or availability impact, and neither changes scope.
The Kubernetes Python client is a common building block for cluster automation and CI jobs, so hosts carrying these packages often hold cluster credentials. That proximity gives two low-scoring disclosure bugs more weight than their numbers suggest. On current exploitation status, FIRST EPSS puts CVE-2018-20060 at a 4.5 percent probability of exploitation in the next 30 days and CVE-2019-11324 at 2.9 percent, with no confirmed in-the-wild activity attached to either. The fixed build is already on Tumbleweed GA media, so exposure is limited to systems not yet rolled forward.
Attack Surface
Supply Chain (Third-party vendors), Endpoint OS, Cloud Service
Tactics
Credential Access, Discovery
Techniques
- T1040 – Network Sniffing
- T1552 – Unsecured Credentials
- T1195.001 – Compromise Software Dependencies and Development Tools
SuperPRO's Threat Countermeasures Procedures
- Update python313-kubernetes and python314-kubernetes to 35.0.0-2.4 on openSUSE Tumbleweed, the fixed build named in openSUSE-SU-2026:12013-1, during the next business-day patch window rather than as an overnight emergency change, given the 2.6 and 4.0 SUSE CVSS 3.0 scores.
- Apply the update with 'zypper refresh && zypper up python313-kubernetes python314-kubernetes' and confirm the result with 'rpm -q python313-kubernetes python314-kubernetes', which must report 35.0.0-2.4.
- Identify in-scope hosts by querying the RPM database with 'rpm -qa | grep -E "python31[34]-kubernetes"' across Tumbleweed workstations, build servers, CI runners and cluster automation nodes.
- Because the fix ships on Tumbleweed GA media, rebuild or re-pull any Tumbleweed container images, VM templates or installation snapshots created before 35.0.0-2.4 so deployed images no longer carry the pre-fix client.
- Pin the package floor in Dockerfiles and provisioning playbooks that install the client, for example 'zypper install -y python313-kubernetes>=35.0.0-2.4', so an image rebuild cannot reintroduce the affected version.
- After updating, rotate kubeconfig tokens and service-account credentials held on Tumbleweed hosts that ran the affected client, since both CVE-2018-20060 and CVE-2019-11324 are scored for confidentiality loss (C:L).
