GitHub Advisoryadvisory · Go

GHSA-h7wq-jj8r-qm7p Kubernetes Nil pointer dereference in KCM after v1 HPA patch request

HIGH Published 2024-11-17 Modified 2024-11-19 Official page ↗
Aliases
CVE-2024-0793
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Weaknesses
CWE-20, CWE-476
Reviewed
2024-11-18

Affected packages

• Go k8s.io/kubernetes: < 1.27.0-alpha.1 → fixed in 1.27.0-alpha.1

Description

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.

Related

Alias · CVE (1)

  • CVE-2024-0793 A flaw was found in kube-controller-manager. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-476 NULL Pointer Dereference weakness

References