Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.7 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.
Recommended action: Upgrade to 0.18.7, 0.17.9 or 0.16.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go k8s.io/apimachinery < 0.0.0-20190927203648-9ce6eca90e73
Fixed in
0.0.0-20190927203648-9ce6eca90e73· Vendor fix available
Issue
CVE-2019-11253 is a denial of service vulnerability in the kube-apiserver, allowing authorized users sending malicious YAML or JSON payloads to cause kube-apiserver to consume excessive CPU or memory, potentially crashing and becoming unavailable. When creating a ConfigMap object which has recursive references contained in it, excessive CPU usage can occur. This appears to be an instance of a "Billion Laughs" attack which is quite well known as an XML parsing issue. Applying this manifest to a cluster causes the client to hang for some time with considerable CPU usage. Specific Go Packages Affected - k8s.io/apimachinery/pkg/runtime/serializer/json - k8s.io/apimachinery/pkg/util/json
Recommended action: Upgrade to 0.0.0-20190927203648-9ce6eca90e73 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.