CVE-2020-8552: Kubernetes API server denial of service
A denial of service vulnerability was found in the Kubernetes API server. This flaw allows a remote attacker to send repeated, crafted HTTP requests to exhaust available memory and cause a crash.
Other sources
A flaw was found in the Kubernetes API server that allows for memory exhaustion and subsequent denial of service. A label in a Kubernetes apiserver metric that reflects the client's user agent is included for debugging purposes, but every value added adds a sustained memory overhead as the metric is now tracked. This is particularly dangerous on commonly unauthenticated APIs (selfsubjectaccessreview for example) and can be performed by any authenticated user.
Upstream Fixes:
1.18: https://github.com/kubernetes/kubernetes/pull/87669 1.17: https://github.com/kubernetes/kubernetes/pull/87673 1.16: https://github.com/kubernetes/kubernetes/pull/87681 1.15: https://github.com/kubernetes/kubernetes/pull/87682
— Red Hat
The Kubernetes API server component in Kubernetes versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.
The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.
Affected Software
Remediation
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-8552?
CVE-2020-8552 is a vulnerability in the Kubernetes API server component that allows for a denial of service attack via successful API requests.
What is the severity of CVE-2020-8552?
The severity of CVE-2020-8552 is medium with a CVSS score of 5.3.
Which versions of Kubernetes are affected by CVE-2020-8552?
Kubernetes versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 are affected by CVE-2020-8552.
How can I fix CVE-2020-8552?
To fix CVE-2020-8552, ensure that you are using Kubernetes version 1.15.9, 1.16.0-1.16.6, or 1.17.0-1.17.2.
Where can I find more information about CVE-2020-8552?
You can find more information about CVE-2020-8552 on the CVE website, NIST's vulnerability database, Kubernetes GitHub issues, Google Groups, and Red Hat Bugzilla and Errata.