VulnerabilityModified

CVE-2019-1002100

MEDIUM 6.5EPSS 10.4%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 10.4%, higher than 95% of all known CVEs. Patch or mitigate before the next change window.

Description

In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: 10.42% probability · 95th percentile
CISA KEV: Not listed
Weakness: CWE-770
Affected: kubernetes/kubernetes · redhat/openshift container platform
Source: josh@bress.net

References

http://www.securityfocus.com/bid/107290Broken Link, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:1851Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3239Third Party Advisory
https://github.com/kubernetes/kubernetes/issues/74534Issue Tracking, Vendor Advisory
https://groups.google.com/forum/#%21topic/kubernetes-announce/vmUUNkYfG9g
https://security.netapp.com/advisory/ntap-20190416-0002/Third Party Advisory
http://www.securityfocus.com/bid/107290Broken Link, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:1851Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3239Third Party Advisory
https://github.com/kubernetes/kubernetes/issues/74534Issue Tracking, Vendor Advisory
https://groups.google.com/forum/#%21topic/kubernetes-announce/vmUUNkYfG9g
https://security.netapp.com/advisory/ntap-20190416-0002/Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.