Skip to content
OpenAdvisories
Medium · 5.3 CVE-2020-8552 EUVD-2022-0898GHSA-82hx-w2r5-c2wq

Kubernetes API server denial of service

Published Mar 27, 2020 · Updated Aug 4, 2024 · Assigned by kubernetes

Vendor: Kubernetes Product: Kubernetes Package: k8s.io/apiserver Package: kubernetes Ecosystem: Debian Ecosystem: Go

Description

The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.

Affected products

VendorProductAffectedFixed
Kubernetes Kubernetes unspecified – < v1.17.3, unspecified – < v1.16.7, unspecified – < v1.15.10 v1.17.3

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 kubernetes 1.17.4-1 —
Debian 13 kubernetes 1.17.4-1 —
Debian 12 kubernetes 1.17.4-1 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 4 openshift +1 4.2.29-202004110432.git.0.f7d02c8.el8 RHSA-2020:1527, RHBA-2020:0929
Red Hat OpenShift 3 atomic-enterprise-service-catalog +1 1:3.11.219-1.git.1.717017c.el7 RHBA-2020:2215
Red Hat OpenShift 3 atomic-openshift +12 3.11.219-1.git.0.0c21387.el7 RHSA-2020:2992, RHBA-2020:2215
Red Hat OpenShift 3 atomic-openshift-cluster-autoscaler 3.11.219-1.git.1.1ad3e34.el7 RHBA-2020:2215
Red Hat OpenShift 3 atomic-openshift-descheduler 3.11.219-1.git.1.7e5b9ee.el7 RHBA-2020:2215
Red Hat OpenShift 3 atomic-openshift-dockerregistry 3.11.219-1.git.1.8323991.el7 RHBA-2020:2215
Red Hat OpenShift 3 atomic-openshift-metrics-server 3.11.219-1.git.1.6fe54fb.el7 RHBA-2020:2215
Red Hat OpenShift 3 atomic-openshift-node-problem-detector 3.11.219-1.git.1.5ae8753.el7 RHBA-2020:2215
Red Hat OpenShift 3 atomic-openshift-service-idler 3.11.219-1.git.1.958cdae.el7 RHBA-2020:2215
Red Hat OpenShift 3 atomic-openshift-web-console 3.11.248-1.git.1.cc96c2d.el7 RHSA-2020:2992
Red Hat OpenShift 3 cri-o 1.11.16-0.10.dev.rhaos3.11.git1eee681.el7 RHSA-2020:2992
Red Hat OpenShift 3 golang-github-openshift-oauth-proxy 3.11.219-1.git.1.076ae14.el7 RHBA-2020:2215
Red Hat OpenShift 3 openshift-ansible +4 3.11.219-1.git.0.8845382.el7 RHBA-2020:2215
Red Hat OpenShift 3 openshift-enterprise-autoheal 3.11.219-1.git.1.c544df9.el7 RHBA-2020:2215
Red Hat OpenShift 3 openshift-enterprise-cluster-capacity 3.11.219-1.git.1.ca1ee51.el7 RHBA-2020:2215
Red Hat OpenShift 3 openshift-kuryr +4 3.11.219-1.git.1.717d59f.el7 RHBA-2020:2215
Red Hat OpenShift 3 prometheus +1 3.11.219-1.git.1.3f6e657.el7 RHBA-2020:2215
Red Hat OpenShift 3 prometheus-alertmanager +1 3.11.219-1.git.1.9a593f8.el7 RHBA-2020:2215
Red Hat OpenShift 3 prometheus-node-exporter +1 3.11.219-1.git.1.7fa9674.el7 RHBA-2020:2215

Affected packages

EcosystemPackageAffectedFixedRecord
Go k8s.io/apiserver < 0.15.10 0.15.10 GHSA-82hx-w2r5-c2wq
Go k8s.io/apiserver >= 0.16.0, < 0.16.7 0.16.7 GHSA-82hx-w2r5-c2wq
Go k8s.io/apiserver >= 0.17.0, < 0.17.3 0.17.3 GHSA-82hx-w2r5-c2wq

Advisories 5

References