Vulnerability CVE-2019-11254 - CERT Civis.Net

Vulnerability Name:

CVE-2019-11254 (CCN-178935)

Assigned:

2019-04-17

Published:

2020-03-31

Updated:

2020-10-02

Summary:

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

CVSS v3 Severity:

6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2019-11254

Source: XF
Type: UNKNOWN
kubernetes-cve201911254-dos(178935)

Source: CCN
Type: Kubernetes GIT Repository
Kubernetes

Source: MISC
Type: Third Party Advisory
https://github.com/kubernetes/kubernetes/issues/89535

Source: MISC
Type: Third Party Advisory
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ

Source: CCN
Type: oss-sec Mailing List, Tue, 31 Mar 2020 16:07:32 -0700
CVE-2019-11254: Kubernetes: denial of service vulnerability from malicious YAML payloads

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20200413-0003/

Source: CCN
Type: IBM Security Bulletin 6208336 (API Connect)
IBM API Connect is impacted by a vulnerability in Kubernetes (CVE-2019-11254)

Source: CCN
Type: IBM Security Bulletin 6261591 (Cloud Private)
IBM Cloud Private is vulnerable to a Kubernetes vulnerability (CVE-2019-11254)

Source: CCN
Type: IBM Security Bulletin 6381242 (Netezza for Cloud Pak for Data)
Open Source Secuity issues fixed for NPS softlayer provisioner.

Source: CCN
Type: IBM Security Bulletin 6382128 (Netezza for Cloud Pak for Data)
Open Source Security issues for NPS console.

Source: CCN
Type: IBM Security Bulletin 6436613 (InfoSphere Information Server)
Multiple vulnerabilities in Kubernetes affect IBM InfoSphere Information Server

Source: CCN
Type: IBM Security Bulletin 6599703 (Db2 On Openshift)
Multiple vulnerabilities affect IBM Db2 On Openshift and IBM Db2 and Db2 Warehouse on Cloud Pak for Data

Source: CCN
Type: IBM Security Bulletin 6833278 (CICS TX Standard)
IBM CICS TX Standard is vulnerable to multiple vulnerabilities in Golang Go and Kubernetes.

Source: CCN
Type: IBM Security Bulletin 6833280 (CICS TX Advanced)
IBM CICS TX Advanced is vulnerable to multiple vulnerabilities in Golang Go and Kubernetes.

Source: CCN
Type: IBM Security Bulletin 7002503 (Cloud Pak for Security)
IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 7007837 (Cloud Pak for Watson AIOps)
Multiple Vulnerabilities in CloudPak for Watson AIOPs

Vulnerable Configuration:

Configuration 1:

cpe:/a:kubernetes:kubernetes:*:*:*:*:*:*:*:* (Version < 1.15.10)

OR cpe:/a:kubernetes:kubernetes:*:*:*:*:*:*:*:* (Version >= 1.16.0 and < 1.16.7)

OR cpe:/a:kubernetes:kubernetes:*:*:*:*:*:*:*:* (Version >= 1.17.0 and < 1.17.3)

Configuration CCN 1:

cpe:/a:kubernetes:kubernetes:1.15.9:-:*:*:*:*:*:*

OR cpe:/a:kubernetes:kubernetes:1.16.0:-:*:*:*:*:*:*

OR cpe:/a:kubernetes:kubernetes:1.16.6:-:*:*:*:*:*:*

OR cpe:/a:kubernetes:kubernetes:1.17.0:-:*:*:*:*:*:*

OR cpe:/a:kubernetes:kubernetes:1.17.2:-:*:*:*:*:*:*

AND

cpe:/a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:api_connect:2018.4.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:api_connect:2018.4.1.10:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_private:3.2.1:cd:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_private:3.2.2:cd:*:*:*:*:*:*

OR cpe:/a:ibm:db2_warehouse:3.5:-:*:*:*:*:*:*

OR cpe:/a:ibm:db2_warehouse:4.0:-:*:*:*:*:*:*

OR cpe:/a:ibm:db2:3.5:-:*:*:*:*:*:*

OR cpe:/a:ibm:db2:4.0:-:*:*:*:*:*:*

OR cpe:/a:ibm:cics_tx:11.1:*:*:*:standard:*:*:*

OR cpe:/a:ibm:cics_tx:11.1:*:*:*:advanced:*:*:*

OR cpe:/a:ibm:cloud_pak_for_security:1.10.0.0:*:*:*:*:*:*:*

Denotes that component is vulnerable