The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
87849953-B423-4E3B-A977-A62A88B40037
1.15.10
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
3D26FF8F-C943-41DE-A97D-89E8C7AB6348
1.16.7
1.16.0
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
95F48D52-C95F-4BBE-87C3-476F8058A37E
1.17.3
1.17.0
OR
CVE-2019-11254 is a denial of service vulnerability in the kube-apiserver, allowing authorized users sending malicious YAML payloads to cause kube-apiserver to consume excessive CPU cycles while parsing YAML.
 
The issue was discovered via the fuzz test kubernetes/kubernetes#83750.
 
**Affected components:**
Kubernetes API server
 
**Affected versions:**
<= v1.15.9, resolved in 1.15.10 by https://github.com/kubernetes/kubernetes/pull/87640
v1.16.0-v1.16.7, resolved in 1.16.8 by https://github.com/kubernetes/kubernetes/pull/87639
v1.17.0-v1.17.2, resolved in 1.17.3 by https://github.com/kubernetes/kubernetes/pull/87637
Fixed in master by https://github.com/kubernetes/kubernetes/pull/87467
 
**How do I mitigate this vulnerability?**
Prior to upgrading, these vulnerabilities can be mitigated by preventing unauthenticated or unauthorized access to kube-apiserver.
CVE-2019-11254: kube-apiserver Denial of Service vulnerability from malicious YAML payloads
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CVE-2019-11254: kube-apiserver Denial of Service vulnerability from malicious YAML payloads
Issue date:

--- start body ---
CVE-2019-11254 is a denial of service vulnerability in the kube-apiserver, allowing authorized users sending malicious YAML payloads to cause kube-apiserver to consume excessive CPU cycles while parsing YAML.
 
The issue was discovered via the fuzz test kubernetes/kubernetes#83750.
 
**Affected components:**
Kubernetes API server
 
**Affected versions:**
<= v1.15.9, resolved in 1.15.10 by https://github.com/kubernetes/kubernetes/pull/87640
v1.16.0-v1.16.7, resolved in 1.16.8 by https://github.com/kubernetes/kubernetes/pull/87639
v1.17.0-v1.17.2, resolved in 1.17.3 by https://github.com/kubernetes/kubernetes/pull/87637
Fixed in master by https://github.com/kubernetes/kubernetes/pull/87467
 
**How do I mitigate this vulnerability?**
Prior to upgrading, these vulnerabilities can be mitigated by preventing unauthenticated or unauthorized access to kube-apiserver.
--- end body ---

comments :
--- start comments ---

--- end comments ---