vulnerability

Oracle Linux: (CVE-2018-16875) (Multiple Advisories): kubernetes kubeadm-ha-setup security update

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:N/I:N/A:C)
Published
Dec 14, 2018
Added
Apr 14, 2019
Modified
Aug 6, 2024

Description

The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.

Solutions

oracle-linux-upgrade-kubeadmoracle-linux-upgrade-kubeadm-ha-setuporacle-linux-upgrade-kubeadm-upgradeoracle-linux-upgrade-kubectloracle-linux-upgrade-kubeletoracle-linux-upgrade-kubernetesoracle-linux-upgrade-kubernetes-cnioracle-linux-upgrade-kubernetes-cni-plugins
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.