Allele Security Alert
ASA-2019-00571
Identifier(s)
ASA-2019-00571, CVE-2019-11253
Title
API Server JSON/YAML parsing vulnerable to resource exhaustion attack
Vendor(s)
Cloud Native Computing Foundation
Product(s)
Kubernetes
Affected version(s)
Kubernetes versions before v1.16.2
Kubernetes versions before v1.15.5
Kubernetes versions before v1.14.8
Kubernetes versions before v1.13.12
Fixed version(s)
Kubernetes version v1.16.2
Kubernetes version v1.15.5
Kubernetes version v1.14.8
Kubernetes version v1.13.12
Proof of concept
Yes
Description
Denial of service vulnerability in the kube-apiserver, allowing authorized users sending malicious YAML or JSON payloads to cause kube-apiserver to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability.
Technical details
Unknown
Credits
Unknown
Reference(s)
CVE-2019-11253: Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack #83253
https://github.com/kubernetes/kubernetes/issues/83253
Analysis of Two Newly Patched Kubernetes Vulnerabilities
https://blog.paloaltonetworks.com/2019/10/cloud-kubernetes-vulnerabilities/
CVE-2019-11253 Kubernetes API Server YAML Parsing Remote Denial of Service PoC aka “Billion Laughs”
https://gist.github.com/bgeesaman/0e0349e94cd22c48bf14d8a9b7d6b8f2
limit yaml/json decode size #83261
https://github.com/kubernetes/kubernetes/pull/83261
[1.13] Automated cherry pick of #83261: bump gopkg.in/yaml.v2 v2.2.4 #83436
https://github.com/kubernetes/kubernetes/pull/83436
[1.14] Automated cherry pick of #83261: bump gopkg.in/yaml.v2 v2.2.4 #83435
https://github.com/kubernetes/kubernetes/pull/83435
[1.15] Automated cherry pick of #83261: bump gopkg.in/yaml.v2 v2.2.4 #83434
https://github.com/kubernetes/kubernetes/pull/83434
[1.16] Automated cherry pick of #83261: bump gopkg.in/yaml.v2 v2.2.4 #83433
https://github.com/kubernetes/kubernetes/pull/83433
CVE-2019-11253
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11253
CVE-2019-11253
https://nvd.nist.gov/vuln/detail/CVE-2019-11253
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: October 21, 2019