Vulnerability CVE-2019-11253

Vulnerability Name:

CVE-2019-11253 (CCN-168618)

Assigned:

2019-09-28

Published:

2019-09-28

Updated:

2020-10-02

Summary:

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.

CVSS v3 Severity:

7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

CWE-776

Vulnerability Consequences:

Denial of Service

References:

Vulnerable Configuration:

Configuration 1:

cpe:/a:kubernetes:kubernetes:*:*:*:*:*:*:*:* (Version >= 1.1.0 and <= 1.12.10)

OR cpe:/a:kubernetes:kubernetes:*:*:*:*:*:*:*:* (Version >= 1.13.0 and < 1.13.2)

OR cpe:/a:kubernetes:kubernetes:*:*:*:*:*:*:*:* (Version >= 1.14.0 and < 1.14.8)

OR cpe:/a:kubernetes:kubernetes:*:*:*:*:*:*:*:* (Version >= 1.15.0 and < 1.15.5)

OR cpe:/a:kubernetes:kubernetes:*:*:*:*:*:*:*:* (Version >= 1.16.0 and < 1.16.2)

Configuration 2:

cpe:/a:redhat:openshift_container_platform:3.9:*:*:*:*:*:*:*

OR cpe:/a:redhat:openshift_container_platform:3.10:*:*:*:*:*:*:*

OR cpe:/a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:kubernetes:kube-apiserver:1.0.0:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.1:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.2:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.3:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.4:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.5:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.6:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.7:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.8:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.9:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.10:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.11:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.11.1:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.11.2:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.11.3:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.11.4:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.11.5:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.11.6:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.11.7:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.12.0:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.12.1:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.12.2:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.12.3:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.12.4:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.12.5:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.13.0:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.13.1:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.13.2:*:*:*:*:*:*:*

OR cpe:/a:kubernetes:kube-apiserver:1.13.3:*:*:*:*:*:*:*

AND

cpe:/a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:api_connect:2018.4.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:watson_studio_local:1.2.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:powerai_vision:1.1.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_private:3.2.0:cd:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_private:3.2.1:cd:*:*:*:*:*:*

OR cpe:/a:ibm:api_connect:2018.4.1.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:powerai_vision:1.1.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:db2_warehouse:3.5:-:*:*:*:*:*:*

OR cpe:/a:ibm:db2_warehouse:4.0:-:*:*:*:*:*:*

OR cpe:/a:ibm:db2:3.5:-:*:*:*:*:*:*

OR cpe:/a:ibm:db2:4.0:-:*:*:*:*:*:*

OR cpe:/a:ibm:cics_tx:11.1:*:*:*:standard:*:*:*

OR cpe:/a:ibm:cics_tx:11.1:*:*:*:advanced:*:*:*

OR cpe:/a:ibm:cloud_pak_for_security:1.10.0.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:112523	P	kubernetes-apiserver-1.22.2-21.2 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:106014	P	kubernetes-apiserver-1.22.2-21.2 on GA media (Moderate)	2021-10-01
oval:com.ubuntu.disco:def:2019112530000000	V	CVE-2019-11253 on Ubuntu 19.04 (disco) - medium.	2019-10-17

BACK