CVE-2019-1002100: Input Validation
A denial of service vulnerability was found in the Kubernetes API server. A remote user, with authorization to apply patches, could exploit this via crafted JSON input, causing excessive consumption of resources and subsequent denial of service.
Other sources
A security issue was discovered in kube-apiserver versions before v1.11.8, v1.12.6, or v1.13.4. Users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type “json-patch” (e.g.kubectl patch --type json or "Content-Type: application/json-patch+json") that consumes excessive resources while processing, causing a Denial of Service on the API Server.
— Red Hat
In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. kubectl patch --type json or "Content-Type: application/json-patch+json") that consumes excessive resources while processing, causing a Denial of Service on the API Server.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this denial of service vulnerability?
The vulnerability ID for this denial of service vulnerability is CVE-2019-1002100.
What is the severity level of CVE-2019-1002100?
The severity level of CVE-2019-1002100 is medium with a score of 6.5.
Which versions of Kubernetes are affected by CVE-2019-1002100?
All Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4 are affected by CVE-2019-1002100.
What is the recommended remedy for CVE-2019-1002100?
The recommended remedy for CVE-2019-1002100 is to update Kubernetes to version 1.11.8, 1.12.6, or 1.13.4.
Where can I find more information about CVE-2019-1002100?
You can find more information about CVE-2019-1002100 on the NIST NVD website, the Kubernetes GitHub page, and the Red Hat errata page.