Ubuntu.comUB:CVE-2019-11253CVE-2019-11253
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.019 Low
EPSS
Percentile
88.3%
Improper input validation in the Kubernetes API server in versions
v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2
allows authorized users to send malicious YAML or JSON payloads, causing
the API server to consume excessive CPU or memory, potentially crashing and
becoming unavailable. Prior to v1.14.0, default RBAC policy authorized
anonymous users to submit requests that could trigger this vulnerability.
Clusters upgraded from a version prior to v1.14.0 keep the more permissive
policy by default for backwards compatibility.
Notes
| Author | Note |
|---|---|
| leosilva | kubernates is in fact a kubernetes installer that calls snap, not the package it self. |
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.019 Low
EPSS
Percentile
88.3%