GitHub Advisoryadvisory · Go

GHSA-qhm4-jxv7-j9pq Allocation of Resources Without Limits or Throttling and Uncontrolled Memory Allocation in Kubernetes

MEDIUM Published 2022-02-15 Modified 2023-01-27 Official page ↗
Aliases
CVE-2020-8551
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
Moderate
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-770, CWE-789
Reviewed
2021-05-06

Affected packages

• Go k8s.io/kubernetes: >= 1.15.0, < 1.15.10 → fixed in 1.15.10 • Go k8s.io/kubernetes: >= 1.16.0, < 1.16.6 → fixed in 1.16.6 • Go k8s.io/kubernetes: >= 1.17.0, < 1.17.2 → fixed in 1.17.2

Description

The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.

Related

Alias · CVE (1)

  • CVE-2020-8551 The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service… vulnerability

Weakness · CWE (2)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness
  • CWE-789 Memory Allocation with Excessive Size Value weakness

References