CVE-2019-11254
Fixed in a distro release EPSS 3%CVSS 6.5
The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.
Products: Kubernetes
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/go-yaml/yaml | no fix |
| Go | gopkg.in/yaml.v2 | 2.2.8 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | dex-k8s-authenticator | 1.4.0-r36 |
| Chainguard | k3d | 5.6.0-r11 |
| Chainguard | k3d-proxy | 5.6.0-r11 |
| Chainguard | k3d-tools | 5.6.0-r11 |
| Debian:12 | kubernetes | 1.17.4-1 |
| Debian:13 | kubernetes | 1.17.4-1 |
| Debian:14 | kubernetes | 1.17.4-1 |
| Red Hat:openshift:3.11 | atomic-openshift | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-clients | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-clients-redistributable | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-docker-excluder | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-excluder | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-hyperkube | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-hypershift | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-master | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-node | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-pod | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-sdn-ovs | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-template-service-broker | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-tests | 0:3.11.232-1.git.0.a5bc32f.el7 |
| Red Hat:openshift:4.5 | machine-config-daemon | 0:4.5.0-202007012112.p0.git.2527.d12c3da.el8 |
| Red Hat:openshift:4.5 | openshift | 0:4.5.0-202007012112.p0.git.0.582d7fc.el7 |
| Red Hat:openshift:4.5 | openshift | 0:4.5.0-202007012112.p0.git.0.582d7fc.el8 |
| Red Hat:openshift:4.5 | openshift-hyperkube | 0:4.5.0-202007012112.p0.git.0.582d7fc.el7 |
| Red Hat:openshift:4.5 | openshift-hyperkube | 0:4.5.0-202007012112.p0.git.0.582d7fc.el8 |
| SUSE:Package Hub 15 SP6 | etcd | 3.5.12-bp156.4.3.1 |
| Ubuntu:22.04:LTS | kubernetes | no fix |
| Ubuntu:24.04:LTS | kubernetes | no fix |
| Ubuntu:Pro:20.04:LTS | kubernetes | no fix |
| Wolfi | k3d | 5.6.0-r11 |
| Wolfi | k3d-proxy | 5.6.0-r11 |
| Wolfi | k3d-tools | 5.6.0-r11 |
| openSUSE:Leap 15.6 | etcd | 3.5.12-bp156.4.3.1 |
| openSUSE:Tumbleweed | etcd | 3.5.2-1.1 |