CVE-2020-8552

Опубликовано: 23 мар. 2020

Источник: redhat

CVSS3: 4.3

EPSS Низкий

Описание

The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.

A denial of service vulnerability was found in the Kubernetes API server. This flaw allows a remote attacker to send repeated, crafted HTTP requests to exhaust available memory and cause a crash.

Меры по смягчению последствий

Prevent unauthenticated or unauthorized access to all APIs

Затронутые пакеты

Платформа	Пакет	Состояние	Рекомендация	Релиз
Red Hat OpenShift Container Platform 4	openshift4/ose-hypershift	Will not fix
Red Hat OpenShift Container Platform 4	openshift4/ose-service-catalog	Will not fix
Red Hat Storage 3	heketi	Not affected
Red Hat OpenShift Container Platform 3.11	atomic-enterprise-service-catalog	Fixed	RHBA-2020:2215	28.05.2020
Red Hat OpenShift Container Platform 3.11	atomic-openshift	Fixed	RHBA-2020:2215	28.05.2020
Red Hat OpenShift Container Platform 3.11	atomic-openshift-cluster-autoscaler	Fixed	RHBA-2020:2215	28.05.2020
Red Hat OpenShift Container Platform 3.11	atomic-openshift-descheduler	Fixed	RHBA-2020:2215	28.05.2020
Red Hat OpenShift Container Platform 3.11	atomic-openshift-dockerregistry	Fixed	RHBA-2020:2215	28.05.2020
Red Hat OpenShift Container Platform 3.11	atomic-openshift-metrics-server	Fixed	RHBA-2020:2215	28.05.2020
Red Hat OpenShift Container Platform 3.11	atomic-openshift-node-problem-detector	Fixed	RHBA-2020:2215	28.05.2020

Показывать по

Ссылки на источники

Дополнительная информация

Статус:

Moderate

Дефект:

CWE-400

https://bugzilla.redhat.com/show_bug.cgi?id=1797909kubernetes: Use of unbounded 'client' label in apiserver_request_total allows for memory exhaustion

EPSS

Процентиль: 38%

0.00161

Низкий

4.3 Medium

CVSS3

Связанные уязвимости

CVE-2020-8552

CVSS3: 5.3

ubuntu

около 5 лет назад

The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.

CVE-2020-8552

CVSS3: 5.3

nvd

около 5 лет назад

The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.

CVE-2020-8552

CVSS3: 5.3

debian

около 5 лет назад

The Kubernetes API server component in versions prior to 1.15.9, 1.16. ...

GHSA-82hx-w2r5-c2wq

CVSS3: 5.3

github

больше 3 лет назад

Kubernetes API Server DoS Via API Requests

EPSS

Процентиль: 38%

0.00161

Низкий

4.3 Medium

CVSS3