CVE-2019-1002100
Fixed in a distro release EPSS 17%CVSS 6.5
In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.
Products: Kubernetes
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | k8s.io/kubernetes | no fix |
| Go | k8s.io/kubernetes | 1.11.8 |
| Go | k8s.io/kubernetes | 1.12.6 |
| Go | k8s.io/kubernetes | 1.13.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | kubeflow-pipelines | 0 |
| Chainguard | kubeflow-pipelines-apiserver | 0 |
| Chainguard | kubeflow-pipelines-cache-deployer | 0 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 0 |
| Chainguard | kubeflow-pipelines-cache_server | 0 |
| Chainguard | kubeflow-pipelines-frontend | 0 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 0 |
| Chainguard | kubeflow-pipelines-metadata-writer | 0 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 0 |
| Chainguard | kubeflow-pipelines-persistence_agent | 0 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 0 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 0 |
| Debian:12 | kubernetes | 1.17.4-1 |
| Debian:13 | kubernetes | 1.17.4-1 |
| Debian:14 | kubernetes | 1.17.4-1 |
| Red Hat:openshift:3.10 | atomic-openshift | 0:3.10.181-1.git.0.3ab4b3d.el7 |
| Red Hat:openshift:3.10 | atomic-openshift-clients | 0:3.10.181-1.git.0.3ab4b3d.el7 |
| Red Hat:openshift:3.10 | atomic-openshift-clients-redistributable | 0:3.10.181-1.git.0.3ab4b3d.el7 |
| Red Hat:openshift:3.10 | atomic-openshift-docker-excluder | 0:3.10.181-1.git.0.3ab4b3d.el7 |
| Red Hat:openshift:3.10 | atomic-openshift-excluder | 0:3.10.181-1.git.0.3ab4b3d.el7 |
| Red Hat:openshift:3.10 | atomic-openshift-hyperkube | 0:3.10.181-1.git.0.3ab4b3d.el7 |
| Red Hat:openshift:3.10 | atomic-openshift-hypershift | 0:3.10.181-1.git.0.3ab4b3d.el7 |
| Red Hat:openshift:3.10 | atomic-openshift-master | 0:3.10.181-1.git.0.3ab4b3d.el7 |
| Red Hat:openshift:3.10 | atomic-openshift-node | 0:3.10.181-1.git.0.3ab4b3d.el7 |
| Red Hat:openshift:3.10 | atomic-openshift-pod | 0:3.10.181-1.git.0.3ab4b3d.el7 |
| Red Hat:openshift:3.10 | atomic-openshift-sdn-ovs | 0:3.10.181-1.git.0.3ab4b3d.el7 |
| Red Hat:openshift:3.10 | atomic-openshift-template-service-broker | 0:3.10.181-1.git.0.3ab4b3d.el7 |
| Red Hat:openshift:3.10 | atomic-openshift-tests | 0:3.10.181-1.git.0.3ab4b3d.el7 |
| Red Hat:openshift:3.11 | atomic-openshift | 0:3.11.129-1.git.0.bd4f2d5.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-clients | 0:3.11.129-1.git.0.bd4f2d5.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-clients-redistributable | 0:3.11.129-1.git.0.bd4f2d5.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-docker-excluder | 0:3.11.129-1.git.0.bd4f2d5.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-excluder | 0:3.11.129-1.git.0.bd4f2d5.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-hyperkube | 0:3.11.129-1.git.0.bd4f2d5.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-hypershift | 0:3.11.129-1.git.0.bd4f2d5.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-master | 0:3.11.129-1.git.0.bd4f2d5.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-node | 0:3.11.129-1.git.0.bd4f2d5.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-pod | 0:3.11.129-1.git.0.bd4f2d5.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-sdn-ovs | 0:3.11.129-1.git.0.bd4f2d5.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-template-service-broker | 0:3.11.129-1.git.0.bd4f2d5.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-tests | 0:3.11.129-1.git.0.bd4f2d5.el7 |
| Red Hat:openshift:3.11 | jenkins-2-plugins | 0:3.11.1560870549-1.el7 |
| Ubuntu:22.04:LTS | kubernetes | no fix |
| Ubuntu:24.04:LTS | kubernetes | no fix |
| Ubuntu:Pro:20.04:LTS | kubernetes | no fix |
| Wolfi | kubeflow-pipelines | 0 |
| Wolfi | kubeflow-pipelines-apiserver | 0 |
| Wolfi | kubeflow-pipelines-cache-deployer | 0 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 0 |
| Wolfi | kubeflow-pipelines-cache_server | 0 |
| Wolfi | kubeflow-pipelines-frontend | 0 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 0 |
| Wolfi | kubeflow-pipelines-metadata-writer | 0 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 0 |
| Wolfi | kubeflow-pipelines-persistence_agent | 0 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 0 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 0 |
| openSUSE:Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 |