GitHub Advisory DatabaseGHSA-82HX-W2R5-C2WQKubernetes API Server DoS Via API Requests
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:N/A:P
0.002 Low
EPSS
Percentile
52.6%
The Kubernetes API server component in Kubernetes versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.
| CPE | Name | Operator | Version |
|---|---|---|---|
| k8s.io/apiserver | lt | 0.17.3 | |
| k8s.io/apiserver | lt | 0.16.7 | |
| k8s.io/apiserver | lt | 0.15.10 |
References
github.com/advisories/GHSA-82hx-w2r5-c2wq
github.com/kubernetes/kubernetes/commit/5978856c4c7f10737a11c9540fe60b8475beecbb
github.com/kubernetes/kubernetes/issues/89378
github.com/kubernetes/kubernetes/pull/87669
groups.google.com/forum/#!topic/kubernetes-security-announce/2UOlsba2g0s
lists.fedoraproject.org/archives/list/[email protected]/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
nvd.nist.gov/vuln/detail/CVE-2020-8552
security.netapp.com/advisory/ntap-20200413-0003/
Related
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:N/A:P
0.002 Low
EPSS
Percentile
52.6%