The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
44ECF71D-7483-45B0-8BF5-92284C11696C
1.15.9
1.15.0
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
02C07F21-ECB7-4BD2-85AF-C2BB24F175FF
1.16.6
1.16.0
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
DE0FF258-1EFA-4FF0-84C7-B2976BD70BD3
1.17.2
1.17.0
OR
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
36D96259-24BD-44E2-96D9-78CE1D41F956
OR
CVSS Rating: [CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) (Medium)

The Kubelet has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.

### Am I vulnerable?

If an attacker can make a request to an unpatched kubelet, then you may be vulnerable to this.

#### Affected Versions

- kubelet v1.17.0 - v1.17.2
- kubelet v1.16.0 - v1.16.6
- kubelet v1.15.0 - v1.15.9

### How do I mitigate this vulnerability?

Limit access to the Kubelet API or patch the Kubelet.

#### Fixed Versions

- v1.17.3
- v1.16.7
- v1.15.10

To upgrade, refer to the documentation: https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster

#### Acknowledgements

This vulnerability was reported by: Henrik Schmidt

/area security
/kind bug
/committee product-security
/sig node
/area kubelet
CVE-2020-8551: Kubelet DoS via API
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CVE-2020-8551: Kubelet DoS via API
Issue date:

--- start body ---
CVSS Rating: [CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) (Medium)

The Kubelet has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.

### Am I vulnerable?

If an attacker can make a request to an unpatched kubelet, then you may be vulnerable to this.

#### Affected Versions

- kubelet v1.17.0 - v1.17.2
- kubelet v1.16.0 - v1.16.6
- kubelet v1.15.0 - v1.15.9

### How do I mitigate this vulnerability?

Limit access to the Kubelet API or patch the Kubelet.

#### Fixed Versions

- v1.17.3
- v1.16.7
- v1.15.10

To upgrade, refer to the documentation: https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster

#### Acknowledgements

This vulnerability was reported by: Henrik Schmidt

/area security
/kind bug
/committee product-security
/sig node
/area kubelet
--- end body ---

comments :
--- start comments ---

--- end comments ---