GO-2022-0509 KubeEdge DoS when signing the CSR from EdgeCore in github.com/kubeedge/kubeedge

KubeEdge DoS when signing the CSR from EdgeCore in github.com/kubeedge/kubeedge...

GO-2022-0511 KubeEdge Cloud Stream and Edge Stream DoS from large stream message in github.com/kubeedge/kubeedge

KubeEdge Cloud Stream and Edge Stream DoS from large stream message in github.com/kubeedge/kubeedge...

GO-2022-0510 KubeEdge CloudCore Router memory exhaustion vulnerability in github.com/kubeedge/kubeedge

KubeEdge CloudCore Router memory exhaustion vulnerability in github.com/kubeedge/kubeedge...

GO-2022-0512 DoS in KubeEdge's Websocket Client in package Viaduct in github.com/kubeedge/kubeedge

DoS in KubeEdge's Websocket Client in package Viaduct in github.com/kubeedge/kubeedge...

GO-2022-0508 KubeEdge Cloud AdmissionController component DoS in github.com/kubeedge/kubeedge

KubeEdge Cloud AdmissionController component DoS in github.com/kubeedge/kubeedge...

GO-2022-0507 KubeEdge Edge ServiceBus module DoS in github.com/kubeedge/kubeedge

KubeEdge Edge ServiceBus module DoS in github.com/kubeedge/kubeedge...

GO-2022-0501 CloudCore CSI Driver: Malicious response from KubeEdge can crash CSI Driver controller server in github.com/kubeedge/kubeedge

CloudCore CSI Driver: Malicious response from KubeEdge can crash CSI Driver controller server in github.com/kubeedge/kubeedge...

Denial Of Service (DoS)

github.com/kubeedge/kubeedge is vulnerable to denial of service DoS attacks. An attacker is able to cause denial of service conditions via memory exhaustion by sending a specifically crafted HTTP request with a large body through the httpHandler function in http.go, because the the library does n...

Denial Of Service (DoS)

github.com/kubeedge/kubeedge is vulnerable to denial of service DoS attacks. An attacker is able to cause denial of service conditions via memory exhaustion by sending a specifically crafted HTTP request with a large body through the signEdgeCert function in server.go...

Denial Of Service (DoS)

github.com/kubeedge/kubeedge is vulnerable to denial of service. The vulnerability exists because Cloud and Edge Stream servers do not properly limit the size of the message that is being read into memory which allows an attacker to send large messages causing a memory exhaustion which then leads...

Denial Of Service (DoS)

github.com/kubeedge/kubeedge is vulnerable to denial of service. An attacker can crash the application by sending a malicious HTTP request with a large body into the processMessage function of servicebus.go when users have enabled the ServiceBus module in the edgecore.yaml config file...

CVE-2022-31080

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, a large response received by the viaduct WSClient can cause a DoS from memory exhaustion. The entire body of the response is...

CVE-2022-31078

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the CloudCore Router does not impose a limit on the size of responses to requests made by the REST handler. An attacker could...

CVE-2022-31075

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, EdgeCore may be susceptible to a DoS attack on CloudHub if an attacker was to send a well-crafted HTTP request to /edge.crt. I...

CVE-2022-31079

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the Cloud Stream server and the Edge Stream server reads the entire message into memory without imposing a limit on the size o...

Authorization

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, EdgeCore may be susceptible to a DoS attack on CloudHub if an attacker was to send a well-crafted HTTP request to /edge.crt. I...

Design/Logic Flaw

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, a large response received by the viaduct WSClient can cause a DoS from memory exhaustion. The entire body of the response is...

Code injection

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the Cloud Stream server and the Edge Stream server reads the entire message into memory without imposing a limit on the size o...

Design/Logic Flaw

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the CloudCore Router does not impose a limit on the size of responses to requests made by the REST handler. An attacker could...

GHSA-6WVC-6PWW-QR4R DoS in KubeEdge's Websocket Client in package Viaduct

Impact A large response received by the viaduct WSClient can cause a DoS from memory exhaustion. The entire body of the response is being read into memory which could allow an attacker to send a request that returns a response with a large body. The consequence of the exhaustion is that the proce...