Fluid Attacks Database

Description

Excessive Platform Resource Consumption within a Loop in Kubernetes The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
go	github.com/go-yaml/yaml	>=0 <=2.1.0	-
go	gopkg.in/yaml.v2	>=0 <2.2.8	2.2.8
debian 11	kubernetes	>=0 <1.17.4-1	1.17.4-1
debian 14	kubernetes	>=0 <1.17.4-1	1.17.4-1
debian 13	kubernetes	>=0 <1.17.4-1	1.17.4-1
debian 12	kubernetes	>=0 <1.17.4-1	1.17.4-1

Aliases

1. CVE-2019-112542. NVD-2019-112543. OSV-2019-112544. OSV-DEBIAN-2019-112545. GCVE-2019-112546. SECURITY-TRACKER-CVE-2019-11254

References

1. https://github.com/kubernetes/kubernetes/issues/895352. https://github.com/go-yaml/yaml/pull/5553. https://github.com/kubernetes/kubernetes/pull/87467/commits/b86df2bec4f377afc0ca03482ffad2f0a49a83b84. https://github.com/go-yaml/yaml/commit/53403b58ad1b561927d19068c655246f2db79d485. https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=184966. https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ7. https://pkg.go.dev/vuln/GO-2020-00368. https://security.netapp.com/advisory/ntap-20200413-0003

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.