7.5
CVE-2019-11253
- EPSS 39.06%
- Veröffentlicht 17.10.2019 16:15:10
- Zuletzt bearbeitet 21.11.2024 04:20:48
- Quelle jordan@liggitt.net
- Teams Watchlist Login
- Unerledigt Login
Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Kubernetes ≫ Kubernetes Version >= 1.1.0 <= 1.12.10
Kubernetes ≫ Kubernetes Version >= 1.13.0 < 1.13.2
Kubernetes ≫ Kubernetes Version >= 1.14.0 < 1.14.8
Kubernetes ≫ Kubernetes Version >= 1.15.0 < 1.15.5
Kubernetes ≫ Kubernetes Version >= 1.16.0 < 1.16.2
Redhat ≫ Openshift Container Platform Version3.9
Redhat ≫ Openshift Container Platform Version3.10
Redhat ≫ Openshift Container Platform Version3.11
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 39.06% | 0.972 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
| jordan@liggitt.net | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.