Kubernetes DoS Vulnerability

2022-05-1301:21:42

Google

osv.dev

6.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.7%

JSON

In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type “json-patch” (e.g. kubectl patch --type json or "Content-Type: application/json-patch+json") that consumes excessive resources while processing, causing a Denial of Service on the API Server.

CPENameOperatorVersion
k8s.io/kubernetesge1.13.0
k8s.io/kuberneteslt1.12.6
k8s.io/kubernetesge1.12.0
k8s.io/kubernetesge1.0
k8s.io/kubernetesle1.10
k8s.io/kuberneteslt1.11.8
k8s.io/kubernetesge1.11.0
k8s.io/kuberneteslt1.13.4

Name	Operator	Version
k8s.io/kubernetes	ge	1.13.0
k8s.io/kubernetes	lt	1.12.6
k8s.io/kubernetes	ge	1.12.0
k8s.io/kubernetes	ge	1.0
k8s.io/kubernetes	le	1.10
k8s.io/kubernetes	lt	1.11.8
k8s.io/kubernetes	ge	1.11.0
k8s.io/kubernetes	lt	1.13.4