The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade kubernetes | Jul 30, 2024 | Apr 1, 2020 |
| Kubernetes | — | Upgrade Kubernetes to version 1.15.10Upgrade Kubernetes to version 1.16.8Upgrade Kubernetes to version 1.17.3 | Apr 8, 2020 | Apr 1, 2020 |
| Oracle_linux | — | Upgrade olcne-utilsUpgrade kubeletUpgrade olcne-agentUpgrade olcnectlUpgrade conmonUpgrade olcne-nginxUpgrade cri-toolsUpgrade kubectlUpgrade cri-oUpgrade kubeadmUpgrade olcne-api-server | Apr 18, 2020 | Apr 1, 2020 |
| Redhat Openshift | — | Upgrade openshiftUpgrade atomic-openshift | Dec 29, 2020 | Mar 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub