CVE-2019-11253: XML Entity Expansion and Improper Input Validation in Kubernetes API server
Summary
CVE-2019-11253: XML Entity Expansion and Improper Input Validation in Kubernetes API server. Affects k8s.io/kubernetes across 4 version ranges.
>= 1.0.0, < 1.13.12
>= 1.14.0, < 1.14.8
>= 1.15.0, < 1.15.5
>= 1.16.0, < 1.16.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- kubernetes · Debian:11
The same CVE-2019-11253 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kubernetes API server is a component of the Kubernetes system that provides a RESTful interface for managing and interacting with Kubernetes clusters. It is responsible for handling requests from users and other components, and coordinating the actions necessary to fulfill those requests. The API server is written in Go and is a critical component of the Kubernetes ecosystem.
Vulnerability Detail
The Kubernetes API server is vulnerable to XML entity expansion and improper input validation. This vulnerability allows authorized users to send malicious YAML or JSON payloads, which can cause the API server to consume excessive CPU or memory. This can potentially lead to the server crashing and becoming unavailable. The vulnerability exists in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2. Prior to v1.14.0, the default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 retain the more permissive policy by default for backwards compatibility.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.13.121.13.12go get k8s.io/kubernetes@v1.13.12 -
>= 1.14.0, < 1.14.81.14.8go get k8s.io/kubernetes@v1.14.8 -
>= 1.15.0, < 1.15.51.15.5go get k8s.io/kubernetes@v1.15.5 -
>= 1.16.0, < 1.16.21.16.2go get k8s.io/kubernetes@v1.16.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to apply the fix by upgrading to a fixed version of the Kubernetes API server.
Conclusion
The Kubernetes API server is vulnerable to XML entity expansion and improper input validation, which can allow authorized users to send malicious payloads and potentially crash the server. It is recommended to upgrade to a fixed version of the Kubernetes API server and review RBAC policies to prevent exploitation of this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for k8s.io/kubernetes →
FAQ
This vulnerability allows authorized users to send malicious payloads to the Kubernetes API server, causing it to consume excessive CPU or memory. This can potentially lead to the server crashing and becoming unavailable.
Versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 are affected by this vulnerability.
Yes, clusters upgraded from a version prior to v1.14.0 retain the more permissive RBAC policy by default, which allows anonymous users to submit requests that could trigger this vulnerability.
RBAC stands for Role-Based Access Control and is a method of regulating access to computer or network resources based on the roles of individual users. In the context of this vulnerability, prior to v1.14.0, the default RBAC policy authorized anonymous users to submit requests that could trigger the vulnerability.
Yes, the CVSS score for this vulnerability is 7.5.
References
Related vulnerabilities
Recent vulnerabilities recorded for k8s.io/kubernetes.
