CVE-2019-11254: Kubernetes API Server denial of service vulnerability from malicious YAML payloads
First published: Fri Mar 27 2020(Updated: )
A denial of service vulnerability was found in the kube-apiserver, allowing authorized users sending malicious YAML payloads to cause kube-apiserver to consume excessive CPU cycles while parsing YAML. Upstream Issue: <a href="https://github.com/kubernetes/kubernetes/issues/89535">https://github.com/kubernetes/kubernetes/issues/89535</a>
Credit: jordan@liggitt.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Kubernetes Kubernetes | <1.15.10 | |
| Kubernetes Kubernetes | >=1.16.0<1.16.7 | |
| Kubernetes Kubernetes | >=1.17.0<1.17.3 | |
| redhat/atomic-openshift | <0:3.11.232-1.git.0.a5bc32f.el7 | 0:3.11.232-1.git.0.a5bc32f.el7 |
| redhat/openshift | <0:4.5.0-202007012112.p0.git.0.582d7fc.el8 | 0:4.5.0-202007012112.p0.git.0.582d7fc.el8 |
Remedy
Prevent unauthenticated or unauthorized access to the API server
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/kubernetes/kubernetes/issues/89535
- https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
- https://security.netapp.com/advisory/ntap-20200413-0003/
- https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
- https://github.com/go-yaml/yaml/pull/555
- https://access.redhat.com/errata/RHSA-2020:2479
- https://access.redhat.com/security/cve/cve-2019-11254
- https://access.redhat.com/errata/RHSA-2020:2413
- https://access.redhat.com/errata/RHSA-2020:2412
- https://bugzilla.redhat.com/show_bug.cgi?id=1819486
- https://www.cve.org/CVERecord?id=CVE-2019-11254 https://nvd.nist.gov/vuln/detail/CVE-2019-11254 https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2019-11254?
CVE-2019-11254 is a vulnerability in the Kubernetes API Server component that allows an authorized user to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML payloads.
How does CVE-2019-11254 affect Kubernetes?
CVE-2019-11254 affects Kubernetes versions 1.1-1.14 and versions prior to 1.15.10, 1.16.7, and 1.17.3.
What is the severity of CVE-2019-11254?
CVE-2019-11254 has a severity rating of 6.5 (medium).
How can I fix CVE-2019-11254?
To fix CVE-2019-11254, update your Kubernetes version to 1.15.10, 1.16.7, or 1.17.3.
Where can I find more information about CVE-2019-11254?
You can find more information about CVE-2019-11254 on the CVE website, NIST's vulnerability database, and Red Hat's security advisories.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/author
- agent/severity
- agent/references
- agent/remedy
- agent/weakness
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-11254
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/tags
- agent/description
- agent/event
- package-manager/redhat
- vendor/kubernetes
- canonical/kubernetes kubernetes
- version/kubernetes kubernetes/1.16.0
- version/kubernetes kubernetes/1.17.0