GitHub Advisoryadvisory · Go

GHSA-82hx-w2r5-c2wq Kubernetes API Server DoS Via API Requests

MEDIUM Published 2022-02-15 Modified 2023-09-20 Official page ↗
Aliases
CVE-2020-8552
Ecosystem
Go
Packages
k8s.io/apiserver
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400, CWE-770, CWE-789
Reviewed
2021-05-06

Affected packages

• Go k8s.io/apiserver: < 0.15.10 → fixed in 0.15.10 • Go k8s.io/apiserver: >= 0.16.0, < 0.16.7 → fixed in 0.16.7 • Go k8s.io/apiserver: >= 0.17.0, < 0.17.3 → fixed in 0.17.3

Description

The Kubernetes API server component in Kubernetes versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.

Related

Alias · CVE (1)

  • CVE-2020-8552 The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a… vulnerability

Weakness · CWE (3)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness
  • CWE-789 Memory Allocation with Excessive Size Value weakness

References