Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing

🗓️ 08 Feb 2023 00:35:27Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 116 Views

Kubernetes apimachinery packages vulnerability in JSON/YAML parsin

Reporter	Title	Published	Views	Family All 113
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes API server security vulnerability (CVE-2019-11253)	25 Oct 201916:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data	28 Mar 202517:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM CICS TX Standard is vulnerable to multiple vulnerabilities in Golang Go and Kubernetes.	14 Feb 202321:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM CICS TX Advanced is vulnerable to multiple vulnerabilities in Golang Go and Kubernetes.	14 Feb 202321:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	8 Jun 202321:56	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Security issues for AWS storage layer in NPS.	10 Dec 202011:16	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private for Data V2.1.0 NGINX (CVE-2019-12206, CVE-2019-12207, CVE-2019-12208, CVE-2019-20372), Docker (CVE-2019-17149, CVE-2019-17150), Kubernetes (CVE-2019-11245, CVE-2019-11253, CVE-2019-1022	6 Mar 202020:58	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in Kubernetes shipped with PowerAI Vision	8 Jan 202016:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Kubernetes affects IBM Watson Studio Local	20 Dec 201913:53	–	ibm
IBM Security Bulletins	Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by Kubernetes API server security vulnerability (CVE-2019-11253)	6 Dec 201917:49	–	ibm

Vulners

Node

k8s.io apimachineryRange<0.0.0-20190927203648-9ce6eca90e73go

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-11253
github	www.github.com/kubernetes/kubernetes/pull/83261
github	www.github.com/advisories/GHSA-pmqp-h87c-mr78
pkg	www.pkg.go.dev/vuln/GO-2022-0965
github	www.github.com/kubernetes/kubernetes/issues/83253
groups	www.groups.google.com/g/kubernetes-security-announce/c/jk8polzSUxs
stackoverflow	www.stackoverflow.com/questions/58129150/security-yaml-bomb-user-can-restart-kube-api-by-sending-configmap
github	www.github.com/advisories/GHSA-74fp-r6jw-h4mp

20 May 2024 21:45Current

8.5High risk

Vulners AI Score8.5

CVSS 25

CVSS 3.17.5

EPSS0.84511