CVE-2019-1002100

State: Published
Severity: 6.5 Medium
Published: Apr 1, 2019
Updated: Aug 5, 2024
Reserved: Apr 1, 2019

Description

In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.

Scores

CVSS	Score	Vector	Source
3.0	6.5 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	dwf

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
KubernetesKubernetes	v1.0.xAffected v1.1.xAffected v1.2.xAffected v1.3.xAffected v1.4.xAffected v1.5.xAffected v1.6.xAffected v1.7.xAffected v1.8.xAffected v1.9.xAffected v1.10.xAffected before v1.11.8Affected before v1.12.6Affected before v1.13.4Affected

References

107290vdb-entry
https://groups.google.com/forum/#%21topic/kubernetes-announce/vmUUNkYfG9g
https://github.com/kubernetes/kubernetes/issues/74534
https://security.netapp.com/advisory/ntap-20190416-0002/
RHSA-2019:1851vendor-advisory
RHSA-2019:3239vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.