CVE-2019-11253

Description

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.

Risk Information

Base Score

7.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

81.025

Associated Vulnerability

Vulnerability	OS Platform
Kubeadm update (ELSA-2019-4816) kubeadm-1.12.10-1.0.10.el7.x86_64.rpm	Linux
Kubeadm-ha-setup update (ELSA-2019-4816) kubeadm-ha-setup-0.0.2-1.0.68.el7.x86_64.rpm	Linux
Kubeadm-upgrade update (ELSA-2019-4816) kubeadm-upgrade-0.0.1-1.0.27.el7.x86_64.rpm	Linux
Kubectl update (ELSA-2019-4816) kubectl-1.12.10-1.0.10.el7.x86_64.rpm	Linux
Kubelet update (ELSA-2019-4816) kubelet-1.12.10-1.0.10.el7.x86_64.rpm	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234