GitHub Advisoryadvisory · Go

GHSA-q4rr-64r9-fwgf Kubernetes DoS Vulnerability

MEDIUM Published 2022-05-13 Modified 2026-01-16 Official page ↗
Aliases
CVE-2019-1002100
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2023-07-19

Affected packages

• Go k8s.io/kubernetes: >= 1.0.0, <= 1.10.14 (no fix yet) • Go k8s.io/kubernetes: >= 1.11.0, < 1.11.8 → fixed in 1.11.8 • Go k8s.io/kubernetes: >= 1.12.0, < 1.12.6 → fixed in 1.12.6 • Go k8s.io/kubernetes: >= 1.13.0, < 1.13.4 → fixed in 1.13.4

Description

In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.

Related

Alias · CVE (1)

  • CVE-2019-1002100 In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References