The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
07761E41-21F4-466F-A602-4DC9BD1257CE
1.15.9
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
02C07F21-ECB7-4BD2-85AF-C2BB24F175FF
1.16.6
1.16.0
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
DE0FF258-1EFA-4FF0-84C7-B2976BD70BD3
1.17.2
1.17.0
OR
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
36D96259-24BD-44E2-96D9-78CE1D41F956
OR
CVSS Rating: [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) (Medium)

The Kubernetes API server has been found to be vulnerable to a denial of service attack via authorized API requests.

### Am I vulnerable?

If an attacker that can make an authorized resource request to an unpatched API server (see below), then you are vulnerable to this. Prior to v1.14, this was possible via unauthenticated requests by default.

#### Affected Versions

- kube-apiserver v1.17.0 - v1.17.2
- kube-apiserver v1.16.0 - v1.16.6
- kube-apiserver < v1.15.10

### How do I mitigate this vulnerability?

Prior to upgrading, this vulnerability can be mitigated by:
- Preventing unauthenticated or unauthorized access to all apis
- The apiserver should auto restart if it OOMs

#### Fixed Versions

- v1.17.3
- v1.16.7
- v1.15.10

To upgrade, refer to the documentation: https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster

#### Acknowledgements

This vulnerability was reported by: Gus Lees (Amazon)

/area security
/kind bug
/committee product-security
/sig api-machinery
CVE-2020-8552: apiserver DoS (oom)
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CVE-2020-8552: apiserver DoS (oom)
Issue date:

--- start body ---
CVSS Rating: [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) (Medium)

The Kubernetes API server has been found to be vulnerable to a denial of service attack via authorized API requests.

### Am I vulnerable?

If an attacker that can make an authorized resource request to an unpatched API server (see below), then you are vulnerable to this. Prior to v1.14, this was possible via unauthenticated requests by default.

#### Affected Versions

- kube-apiserver v1.17.0 - v1.17.2
- kube-apiserver v1.16.0 - v1.16.6
- kube-apiserver < v1.15.10

### How do I mitigate this vulnerability?

Prior to upgrading, this vulnerability can be mitigated by:
- Preventing unauthenticated or unauthorized access to all apis
- The apiserver should auto restart if it OOMs

#### Fixed Versions

- v1.17.3
- v1.16.7
- v1.15.10

To upgrade, refer to the documentation: https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster

#### Acknowledgements

This vulnerability was reported by: Gus Lees (Amazon)

/area security
/kind bug
/committee product-security
/sig api-machinery
--- end body ---

comments :
--- start comments ---

--- end comments ---