Database/Container, Kubernetes & orchestration

Kubernetes (kube-apiserver): YAML parsing CPU exhaustion in the apiserver

CVSS 6.5CVE-2019-11254Container, Kubernetes & orchestrationcurated

Impact

YAML parsing CPU exhaustion in the apiserver

Who can reach it

Any authorized cluster user

What to do

Rolling control-plane upgrade; no GPU drain

References

https://nvd.nist.gov/vuln/detail/CVE-2019-11254

Related entries

Kubernetes (kube-apiserver): Node updates bypass a validating admission webhook, defeating node-level policyCVE-2021-25735 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Users authorized to list/watch one namespaced CR type can read other CR types in the sameCVE-2022-3162 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Ephemeral containers bypass the ImagePolicyWebhook, so unapproved images runCVE-2023-2727 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Ephemeral containers bypass the ServiceAccount mountable-secrets policyCVE-2023-2728 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Unvalidated redirect on proxied upgrade requests lets a compromised node escalate to otherCVE-2020-8559 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Any user who can create a Service with externalIPs (or patch LB status) intercepts clusterCVE-2020-8554 · Kubernetes (kube-apiserver)Medium

All Container, Kubernetes & orchestration entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.