CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
88.5%
Improper input validation in the Kubernetes API server in versions
v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2
allows authorized users to send malicious YAML or JSON payloads, causing
the API server to consume excessive CPU or memory, potentially crashing and
becoming unavailable. Prior to v1.14.0, default RBAC policy authorized
anonymous users to submit requests that could trigger this vulnerability.
Clusters upgraded from a version prior to v1.14.0 keep the more permissive
policy by default for backwards compatibility.
Author | Note |
---|---|
leosilva | kubernates is in fact a kubernetes installer that calls snap, not the package it self. |
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
88.5%