CVE-2019-1002100

In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a…

Medium · published April 1, 2019

CVSS v3.0

6.5

EPSS

17%

Percentile

97.1

In the wild

Unconfirmed

What it is

In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.

The record

Technical detail

CVSS v3.0: 6.5 · MEDIUM
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.16934 · 97.1th percentile
Published: 2019-04-01T14:14Z

EPSS history

Timeline

01 APR 14:14Z
In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a…
cvelistv5