Description
An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6443) cause denial of service.
This issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.0 before v1.25.13+k3s1, from v1.26.0 before v1.26.8+k3s1, from sev1.27.0 before v1.27.5+k3s1, from v1.28.0 before v1.28.1+k3s1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE | k3s | v1.24.0 – < v1.24.17+k3s1, v1.25.0 – < v1.25.13+k3s1, v1.26.0 – < v1.26.8+k3s1, sev1.27.0 – < v1.27.5+k3s1, v1.28.0 – < v1.28.1+k3s1 | v1.24.17+k3s1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | k3s | 1.27.5.1-r0 | — |
| Alpine v3.23 | k3s | 1.27.5.1-r0 | — |
| Alpine v3.22 | k3s | 1.27.5.1-r0 | — |
| Alpine v3.21 | k3s | 1.27.5.1-r0 | — |
| Alpine v3.20 | k3s | 1.27.5.1-r0 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | k3s | 1.27.5.1-r0 | — |
| Alpine v3.18 | k3s | 1.27.5.1-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | k3s | 1.27.5-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/k3s-io/k3s | < 1.24.17 | 1.24.17 | GHSA-m4hf-6vgr-75r2 |
| Go | github.com/k3s-io/k3s | >= 1.25.0, < 1.25.13 | 1.25.13 | GHSA-m4hf-6vgr-75r2 |
| Go | github.com/k3s-io/k3s | >= 1.26.0, < 1.26.8 | 1.26.8 | GHSA-m4hf-6vgr-75r2 |
| Go | github.com/k3s-io/k3s | >= 1.27.0, < 1.27.5 | 1.27.5 | GHSA-m4hf-6vgr-75r2 |
| Go | github.com/k3s-io/k3s | >= 1.28.0, < 1.28.1 | 1.28.1 | GHSA-m4hf-6vgr-75r2 |
Advisories 1
- WID-SEC-2023-2303 Kubernetes: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 11, 2023