Description
The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Kubernetes Kubernetes
unspecified to < v1.17.3affectedunspecified to < v1.16.7affectedunspecified to < v1.15.10affected
References
- https://github.com/kubernetes/kubernetes/issues/89377 ↗
- https://groups.google.com/forum/#%21topic/kubernetes-security-announce/2UOlsba2g0s ↗
- https://security.netapp.com/advisory/ntap-20200413-0003/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/ ↗