ALT-PU-2019-3354

Высокий

ALT-PU-2019-3354: package kubernetes update to version 1.16.4-alt1

Источник

errata.altlinux.org

Дата публикации

20.12.2019

Дата обновления

04.02.2026

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades kubernetes to version 1.16.4-alt1.

Устраненные уязвимости2

BDU:2020-00025

Высокий 7.5

Дата публикации: 08.01.2020

Уязвимость библиотеки синтаксического анализатора YAML программного средства управления кластерами виртуальных машин Kubernetes, позволяющая нарушителю вызвать отказ в обслуживании

CVSS 3.1

Высокий 7.5

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS 2.0

Высокий 7.8

AV:N/AC:L/Au:N/C:N/I:N/A:C

Access vector: Network
Complexity: Low
Authentication: None
Confidentiality: None
Integrity: None
Availability: Complete

Ссылки

BDU:2020-00025 https://bdu.fstec.ru/vul/2020-00025

Ссылки3

ALT-PU-2019-3354 https://errata.altlinux.org/ALT-PU-2019-3354

GHSA-74fp-r6jw-h4mp

https://github.com/advisories/GHSA-74fp-r6jw-h4mp

GHSA-pmqp-h87c-mr78

https://github.com/advisories/GHSA-pmqp-h87c-mr78

Связанные уязвимости

CVE-2019-11253

CVSS3: 7.5

ubuntu

около 7 лет назад

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.