CVE-2020-8552
Fixed in a distro release EPSS 2%CVSS 5.3
The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.
Products: Kubernetes
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | k8s.io/apiserver | 0.15.10 |
| Go | k8s.io/apiserver | 0.16.7 |
| Go | k8s.io/apiserver | 0.17.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | argo-cd-2.7 | 0 |
| Chainguard | argo-cd-2.7-compat | 0 |
| Chainguard | argo-cd-2.7-repo-server | 0 |
| Chainguard | argo-cd-2.8 | 0 |
| Chainguard | argo-cd-2.8-compat | 0 |
| Chainguard | argo-cd-2.8-repo-server | 0 |
| Chainguard | aws-ebs-csi-driver | 0 |
| Chainguard | aws-ebs-csi-driver-1.18 | 0 |
| Chainguard | aws-ebs-csi-driver-1.19 | 0 |
| Chainguard | calico | 0 |
| Chainguard | calico-apiserver | 0 |
| Chainguard | calico-app-policy | 0 |
| Chainguard | calico-cni | 0 |
| Chainguard | calico-cni-compat | 0 |
| Chainguard | calico-felix | 0 |
| Chainguard | calico-key-cert-provisioner | 0 |
| Chainguard | calico-kube-controllers | 0 |
| Chainguard | calico-node | 0 |
| Chainguard | calico-pod2daemon | 0 |
| Chainguard | calico-pod2daemon-flexvol-compat | 0 |
| Chainguard | calico-typha-client | 0 |
| Chainguard | calico-typhad | 0 |
| Chainguard | calicoctl | 0 |
| Chainguard | cert-manager-1.11 | 0 |
| Chainguard | cert-manager-1.11-acmesolver | 0 |
| Chainguard | cert-manager-1.11-cainjector | 0 |
| Chainguard | cert-manager-1.11-controller | 0 |
| Chainguard | cert-manager-1.11-webhook | 0 |
| Chainguard | cert-manager-1.12 | 0 |
| Chainguard | cert-manager-1.12-acmesolver | 0 |
| Chainguard | cert-manager-1.12-cainjector | 0 |
| Chainguard | cert-manager-1.12-controller | 0 |
| Chainguard | cert-manager-1.12-webhook | 0 |
| Chainguard | cert-manager-acmesolver-1.12 | 0 |
| Chainguard | cert-manager-acmesolver-1.12-bitnami-compat | 0 |
| Chainguard | cert-manager-acmesolver-1.12-iamguarded-compat | 0 |
| Chainguard | cert-manager-cainjector-1.12 | 0 |
| Chainguard | cert-manager-cainjector-1.12-bitnami-compat | 0 |
| Chainguard | cert-manager-cainjector-1.12-iamguarded-compat | 0 |
| Chainguard | cert-manager-controller-1.12 | 0 |
| Chainguard | cert-manager-controller-1.12-bitnami-compat | 0 |
| Chainguard | cert-manager-controller-1.12-iamguarded-compat | 0 |
| Chainguard | cert-manager-webhook-1.12 | 0 |
| Chainguard | cert-manager-webhook-1.12-bitnami-compat | 0 |
| Chainguard | cert-manager-webhook-1.12-iamguarded-compat | 0 |
| Chainguard | cmctl-1.11 | 0 |
| Chainguard | cmctl-1.12 | 0 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-1.23 | 0 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-1.25 | 0 |
| Chainguard | flux-helm-controller | 0 |
| Chainguard | flux-helm-controller-0 | 0 |
| Chainguard | flux-helm-controller-0.37 | 0 |
| Chainguard | flux-helm-controller-bitnami-compat | 0 |
| Chainguard | flux-helm-controller-iamguarded-compat | 0 |
| Chainguard | gatekeeper-3.12 | 0 |
| Chainguard | gatekeeper-3.12-compat | 0 |
| Chainguard | gatekeeper-3.13 | 0 |
| Chainguard | gatekeeper-3.13-compat | 0 |
| Chainguard | haproxy-ingress | 0 |
| Chainguard | haproxy-ingress-compat | 0 |
| Chainguard | helm | 0 |
| Chainguard | helm-3 | 0 |
| Chainguard | helm-4 | 0 |
| Chainguard | istio-pilot-agent-1.18 | 0 |
| Chainguard | istio-pilot-agent-1.18-compat | 0 |
| Chainguard | istio-pilot-agent-fips-1.19 | 0 |
| Chainguard | istio-pilot-agent-fips-1.19-compat | 0 |
| Chainguard | istio-pilot-discovery-1.19 | 0 |
| Chainguard | istio-pilot-discovery-1.19-compat | 0 |
| Chainguard | istio-pilot-discovery-fips-1.19 | 0 |
| Chainguard | istio-pilot-discovery-fips-1.19-compat | 0 |
| Chainguard | k8sgpt | 0 |
| Chainguard | kargo | 0 |
| Chainguard | kargo-oci-compat | 0 |
| Chainguard | keda | 0 |
| Chainguard | keda-2.10 | 0 |
| Chainguard | keda-2.10-adapter | 0 |
| Chainguard | keda-2.10-admission-webhooks | 0 |
| Chainguard | keda-2.10-compat | 0 |
| Chainguard | keda-2.8 | 0 |
| Chainguard | keda-2.9 | 0 |
| Chainguard | keda-adapter | 0 |
| Chainguard | keda-adapter-2.10 | 0 |
| Chainguard | keda-adapter-2.8 | 0 |
| Chainguard | keda-adapter-2.9 | 0 |
| Chainguard | keda-admission-webhooks | 0 |
| Chainguard | keda-admission-webhooks-2.10 | 0 |
| Chainguard | keda-compat | 0 |
| Chainguard | keda-compat-2.10 | 0 |
| Chainguard | keda-compat-2.8 | 0 |
| Chainguard | keda-compat-2.9 | 0 |
| Chainguard | kube-oidc-proxy | 0 |
| Chainguard | kubeflow-pipelines | 0 |
| Chainguard | kubeflow-pipelines-apiserver | 0 |
| Chainguard | kubeflow-pipelines-cache-deployer | 0 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 0 |
| Chainguard | kubeflow-pipelines-cache_server | 0 |
| Chainguard | kubeflow-pipelines-frontend | 0 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 0 |
| Chainguard | kubeflow-pipelines-metadata-writer | 0 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 0 |
| Chainguard | kubeflow-pipelines-persistence_agent | 0 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 0 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 0 |
| Chainguard | kubernetes-csi-external-provisioner | 0 |
| Chainguard | kubernetes-csi-external-resizer | 0 |
| Chainguard | kubevela | 0 |
| Chainguard | kubevela-vela-cli | 0 |
| Chainguard | kubevela-vela-core | 0 |
| Chainguard | kubevela-vela-core-compat | 0 |
| Chainguard | metrics-server | 0 |
| Chainguard | metrics-server-bitnami-compat | 0 |
| Chainguard | metrics-server-compat | 0 |
| Chainguard | metrics-server-iamguarded-compat | 0 |
| Chainguard | vela-cli | 0 |
| Chainguard | vela-core | 0 |
| Debian 12 | kubernetes | 1.17.4-1 |
| Debian 13 | kubernetes | 1.17.4-1 |
| Debian 14 | kubernetes | 1.17.4-1 |
| Red Hat openshift 3.11 | atomic-enterprise-service-catalog | 1:3.11.219-1.git.1.717017c.el7 |
| Red Hat openshift 3.11 | atomic-enterprise-service-catalog-svcat | 1:3.11.219-1.git.1.717017c.el7 |
| Red Hat openshift 3.11 | atomic-openshift | 0:3.11.219-1.git.0.0c21387.el7 |
| Red Hat openshift 3.11 | atomic-openshift | 0:3.11.248-1.git.0.92ee8ac.el7 |
| Red Hat openshift 3.11 | atomic-openshift-clients | 0:3.11.248-1.git.0.92ee8ac.el7 |
| Red Hat openshift 3.11 | atomic-openshift-clients | 0:3.11.219-1.git.0.0c21387.el7 |
| Red Hat openshift 3.11 | atomic-openshift-clients-redistributable | 0:3.11.248-1.git.0.92ee8ac.el7 |
| Red Hat openshift 3.11 | atomic-openshift-clients-redistributable | 0:3.11.219-1.git.0.0c21387.el7 |
| Red Hat openshift 3.11 | atomic-openshift-cluster-autoscaler | 0:3.11.219-1.git.1.1ad3e34.el7 |
| Red Hat openshift 3.11 | atomic-openshift-descheduler | 0:3.11.219-1.git.1.7e5b9ee.el7 |
| Red Hat openshift 3.11 | atomic-openshift-docker-excluder | 0:3.11.219-1.git.0.0c21387.el7 |
| Red Hat openshift 3.11 | atomic-openshift-docker-excluder | 0:3.11.248-1.git.0.92ee8ac.el7 |
| Red Hat openshift 3.11 | atomic-openshift-dockerregistry | 0:3.11.219-1.git.1.8323991.el7 |
| Red Hat openshift 3.11 | atomic-openshift-excluder | 0:3.11.219-1.git.0.0c21387.el7 |
| Red Hat openshift 3.11 | atomic-openshift-excluder | 0:3.11.248-1.git.0.92ee8ac.el7 |
| Red Hat openshift 3.11 | atomic-openshift-hyperkube | 0:3.11.219-1.git.0.0c21387.el7 |
| Red Hat openshift 3.11 | atomic-openshift-hyperkube | 0:3.11.248-1.git.0.92ee8ac.el7 |
| Red Hat openshift 3.11 | atomic-openshift-hypershift | 0:3.11.248-1.git.0.92ee8ac.el7 |
| Red Hat openshift 3.11 | atomic-openshift-hypershift | 0:3.11.219-1.git.0.0c21387.el7 |
| Red Hat openshift 3.11 | atomic-openshift-master | 0:3.11.219-1.git.0.0c21387.el7 |
| Red Hat openshift 3.11 | atomic-openshift-master | 0:3.11.248-1.git.0.92ee8ac.el7 |
| Red Hat openshift 3.11 | atomic-openshift-metrics-server | 0:3.11.219-1.git.1.6fe54fb.el7 |
| Red Hat openshift 3.11 | atomic-openshift-node | 0:3.11.219-1.git.0.0c21387.el7 |
| Red Hat openshift 3.11 | atomic-openshift-node | 0:3.11.248-1.git.0.92ee8ac.el7 |
| Red Hat openshift 3.11 | atomic-openshift-node-problem-detector | 0:3.11.219-1.git.1.5ae8753.el7 |
| Red Hat openshift 3.11 | atomic-openshift-pod | 0:3.11.219-1.git.0.0c21387.el7 |
| Red Hat openshift 3.11 | atomic-openshift-pod | 0:3.11.248-1.git.0.92ee8ac.el7 |
| Red Hat openshift 3.11 | atomic-openshift-sdn-ovs | 0:3.11.219-1.git.0.0c21387.el7 |
| Red Hat openshift 3.11 | atomic-openshift-sdn-ovs | 0:3.11.248-1.git.0.92ee8ac.el7 |
| Red Hat openshift 3.11 | atomic-openshift-service-idler | 0:3.11.219-1.git.1.958cdae.el7 |
| Red Hat openshift 3.11 | atomic-openshift-template-service-broker | 0:3.11.219-1.git.0.0c21387.el7 |
| Red Hat openshift 3.11 | atomic-openshift-template-service-broker | 0:3.11.248-1.git.0.92ee8ac.el7 |
| Red Hat openshift 3.11 | atomic-openshift-tests | 0:3.11.248-1.git.0.92ee8ac.el7 |
| Red Hat openshift 3.11 | atomic-openshift-tests | 0:3.11.219-1.git.0.0c21387.el7 |
| Red Hat openshift 3.11 | atomic-openshift-web-console | 0:3.11.248-1.git.1.cc96c2d.el7 |
| Red Hat openshift 3.11 | cri-o | 0:1.11.16-0.10.dev.rhaos3.11.git1eee681.el7 |
| Red Hat openshift 3.11 | cri-o-debuginfo | 0:1.11.16-0.10.dev.rhaos3.11.git1eee681.el7 |
| Red Hat openshift 3.11 | golang-github-openshift-oauth-proxy | 0:3.11.219-1.git.1.076ae14.el7 |
| Red Hat openshift 3.11 | golang-github-prometheus-alertmanager | 0:3.11.219-1.git.1.9a593f8.el7 |
| Red Hat openshift 3.11 | golang-github-prometheus-node_exporter | 0:3.11.219-1.git.1.7fa9674.el7 |
| Red Hat openshift 3.11 | golang-github-prometheus-prometheus | 0:3.11.219-1.git.1.3f6e657.el7 |
| Red Hat openshift 3.11 | openshift-ansible | 0:3.11.219-1.git.0.8845382.el7 |
| Red Hat openshift 3.11 | openshift-ansible-docs | 0:3.11.219-1.git.0.8845382.el7 |
| Red Hat openshift 3.11 | openshift-ansible-playbooks | 0:3.11.219-1.git.0.8845382.el7 |
| Red Hat openshift 3.11 | openshift-ansible-roles | 0:3.11.219-1.git.0.8845382.el7 |
| Red Hat openshift 3.11 | openshift-ansible-test | 0:3.11.219-1.git.0.8845382.el7 |
| Red Hat openshift 3.11 | openshift-enterprise-autoheal | 0:3.11.219-1.git.1.c544df9.el7 |
| Red Hat openshift 3.11 | openshift-enterprise-cluster-capacity | 0:3.11.219-1.git.1.ca1ee51.el7 |
| Red Hat openshift 3.11 | openshift-kuryr | 0:3.11.219-1.git.1.717d59f.el7 |
| Red Hat openshift 3.11 | openshift-kuryr-cni | 0:3.11.219-1.git.1.717d59f.el7 |
| Red Hat openshift 3.11 | openshift-kuryr-common | 0:3.11.219-1.git.1.717d59f.el7 |
| Red Hat openshift 3.11 | openshift-kuryr-controller | 0:3.11.219-1.git.1.717d59f.el7 |
| Red Hat openshift 3.11 | prometheus | 0:3.11.219-1.git.1.3f6e657.el7 |
| Red Hat openshift 3.11 | prometheus-alertmanager | 0:3.11.219-1.git.1.9a593f8.el7 |
| Red Hat openshift 3.11 | prometheus-node-exporter | 0:3.11.219-1.git.1.7fa9674.el7 |
| Red Hat openshift 3.11 | python2-kuryr-kubernetes | 0:3.11.219-1.git.1.717d59f.el7 |
| Red Hat openshift 4.2 | openshift | 0:4.2.29-202004110432.git.0.f7d02c8.el8 |
| Red Hat openshift 4.2 | openshift | 0:4.2.29-202004120346.git.0.d948116.el7 |
| Red Hat openshift 4.2 | openshift-hyperkube | 0:4.2.29-202004110432.git.0.f7d02c8.el8 |
| Red Hat openshift 4.2 | openshift-hyperkube | 0:4.2.29-202004120346.git.0.d948116.el7 |
| Red Hat openshift 4.3 | openshift | 0:4.3.9-202003230116.git.0.ebf9a26.el7 |
| Red Hat openshift 4.3 | openshift | 0:4.3.9-202003230116.git.0.ebf9a26.el8 |
| Red Hat openshift 4.3 | openshift-hyperkube | 0:4.3.9-202003230116.git.0.ebf9a26.el8 |
| Red Hat openshift 4.3 | openshift-hyperkube | 0:4.3.9-202003230116.git.0.ebf9a26.el7 |
| Ubuntu 22.04 LTS | kubernetes | no fix |
| Ubuntu 24.04 LTS | kubernetes | no fix |
| Ubuntu Pro 20.04 LTS | kubernetes | no fix |
| Wolfi | argo-cd-2.7 | 0 |
| Wolfi | argo-cd-2.7-compat | 0 |
| Wolfi | argo-cd-2.7-repo-server | 0 |
| Wolfi | argo-cd-2.8 | 0 |
| Wolfi | argo-cd-2.8-compat | 0 |
| Wolfi | argo-cd-2.8-repo-server | 0 |
| Wolfi | aws-ebs-csi-driver | 0 |
| Wolfi | calico | 0 |
| Wolfi | calico-apiserver | 0 |
| Wolfi | calico-app-policy | 0 |
| Wolfi | calico-cni | 0 |
| Wolfi | calico-cni-compat | 0 |
| Wolfi | calico-felix | 0 |
| Wolfi | calico-key-cert-provisioner | 0 |
| Wolfi | calico-kube-controllers | 0 |
| Wolfi | calico-node | 0 |
| Wolfi | calico-pod2daemon | 0 |
| Wolfi | calico-pod2daemon-flexvol-compat | 0 |
| Wolfi | calico-typha-client | 0 |
| Wolfi | calico-typhad | 0 |
| Wolfi | calicoctl | 0 |
| Wolfi | cert-manager-1.11 | 0 |
| Wolfi | cert-manager-1.11-acmesolver | 0 |
| Wolfi | cert-manager-1.11-cainjector | 0 |
| Wolfi | cert-manager-1.11-controller | 0 |
| Wolfi | cert-manager-1.11-webhook | 0 |
| Wolfi | cert-manager-1.12 | 0 |
| Wolfi | cert-manager-1.12-acmesolver | 0 |
| Wolfi | cert-manager-1.12-cainjector | 0 |
| Wolfi | cert-manager-1.12-controller | 0 |
| Wolfi | cert-manager-1.12-webhook | 0 |
| Wolfi | cmctl-1.11 | 0 |
| Wolfi | cmctl-1.12 | 0 |
| Wolfi | flux-helm-controller | 0 |
| Wolfi | flux-helm-controller-bitnami-compat | 0 |
| Wolfi | flux-helm-controller-iamguarded-compat | 0 |
| Wolfi | gatekeeper-3.12 | 0 |
| Wolfi | gatekeeper-3.12-compat | 0 |
| Wolfi | gatekeeper-3.13 | 0 |
| Wolfi | gatekeeper-3.13-compat | 0 |
| Wolfi | haproxy-ingress | 0 |
| Wolfi | haproxy-ingress-compat | 0 |
| Wolfi | helm | 0 |
| Wolfi | helm-3 | 0 |
| Wolfi | helm-4 | 0 |
| Wolfi | istio-pilot-agent-1.18 | 0 |
| Wolfi | istio-pilot-agent-1.18-compat | 0 |
| Wolfi | istio-pilot-discovery-1.19 | 0 |
| Wolfi | istio-pilot-discovery-1.19-compat | 0 |
| Wolfi | k8sgpt | 0 |
| Wolfi | kargo | 0 |
| Wolfi | kargo-oci-compat | 0 |
| Wolfi | keda | 0 |
| Wolfi | keda-2.10 | 0 |
| Wolfi | keda-2.10-adapter | 0 |
| Wolfi | keda-2.10-admission-webhooks | 0 |
| Wolfi | keda-2.10-compat | 0 |
| Wolfi | keda-adapter | 0 |
| Wolfi | keda-admission-webhooks | 0 |
| Wolfi | keda-compat | 0 |
| Wolfi | kubeflow-pipelines | 0 |
| Wolfi | kubeflow-pipelines-apiserver | 0 |
| Wolfi | kubeflow-pipelines-cache-deployer | 0 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 0 |
| Wolfi | kubeflow-pipelines-cache_server | 0 |
| Wolfi | kubeflow-pipelines-frontend | 0 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 0 |
| Wolfi | kubeflow-pipelines-metadata-writer | 0 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 0 |
| Wolfi | kubeflow-pipelines-persistence_agent | 0 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 0 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 0 |
| Wolfi | kubernetes-csi-external-provisioner | 0 |
| Wolfi | kubernetes-csi-external-resizer | 0 |
| Wolfi | kubevela | 0 |
| Wolfi | kubevela-vela-cli | 0 |
| Wolfi | kubevela-vela-core | 0 |
| Wolfi | kubevela-vela-core-compat | 0 |
| Wolfi | metrics-server | 0 |
| Wolfi | metrics-server-bitnami-compat | 0 |
| Wolfi | metrics-server-compat | 0 |
| Wolfi | metrics-server-iamguarded-compat | 0 |
| Wolfi | vela-cli | 0 |
| Wolfi | vela-core | 0 |