<p>I am currently playing with kubernetes and read about a security issue (cve-2018-18264) where it was possible to gain unauthorized access to the dashboards secrets (the certificate plus the RSA private key).</p>
<p>Now I am wondering how valuable the RSA private key and the certificate is for an attacker especially in kubernetes? Can someone tell me about?</p>
<p>How about if Diffie-Hellman is used for key exchange?</p>

ItFreak
<p>As said on <a href="https://www.cloudfoundry.org/blog/cve-2018-18264/" rel="nofollow noreferrer">CVE-2018-18264: Kubernetes Dashboard TLS Certificate Leak</a>.</p>

<blockquote>
  <h2>Description</h2>
  
  <p>Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard’s Service Account for reading secrets within the cluster.</p>
</blockquote>

<p>So if You deployed an app, lets take this <a href="https://github.com/GoogleCloudPlatform/kubernetes-engine-samples/blob/master/cloudsql/mysql_wordpress_deployment.yaml" rel="nofollow noreferrer">Mysql Wordpress deployment</a>, attacker might gain access to your DB login and password.</p>

<p>Also if You are using secrets as authentication between application, attacker might use <a href="https://en.wikipedia.org/wiki/Man-in-the-middle_attack" rel="nofollow noreferrer">MITM</a> attack.</p>

<p><a href="https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange" rel="nofollow noreferrer">DH</a> is no longer considered as secure.</p>

<blockquote>
  <p>...
  However, research published in October 2015 suggests that the parameters in use for many DH Internet applications at that time are not strong enough to prevent compromise by very well-funded attackers, such as the security services of large governments.<a href="https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange#cite_note-imperfectfs-4" rel="nofollow noreferrer">[3]</a></p>
  
  <p>Paper talking about this is <a href="https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf" rel="nofollow noreferrer">Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice</a></p>
</blockquote>
