Kubeflow Pipelinesに圧縮データの展開で大量のメモリを消費される脆弱性
Summary
Kubeflow Pipelinesでは、細工した小さなZIPやgzip圧縮のtarアーカイブをアップロードすると、APIサーバーのメモリを使い果たされ、サービスが止まるおそれがあります。影響を受けるのは2.18.0より前のバージョンで、修正版は2.18.0です。CVSSは7.5で、認可の判定より前に展開処理が走るため、利用者は早めに修正版への更新を検討するとよいでしょう。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Kubeflow Pipelinesでは、細工した小さなZIPやgzip圧縮のtarアーカイブをアップロードすると、APIサーバーのメモリを使い果たされ、サービスが止まるおそれがあります。影響を受けるのは2.18.0より前のバージョンで、修正版は2.18.0です。CVSSは7.5で、認可の判定より前に展開処理が走るため、利用者は早めに修正版への更新を検討するとよいでしょう。
Original description The description as published by the source.
Summary
The Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file, potentially exhausting API-server resources and interrupting service.
Multipart pipeline and pipeline-version upload processing decompresses the archive before namespace authorization, so a caller who can reach those endpoints does not need a successful pipeline-create authorization decision to trigger the issue. External authentication and network controls can restrict reachability. URL-import handlers authorize before fetching and decompressing a remote archive.
The amount of expansion needed to exhaust memory depends on deployment resource limits and concurrent activity; no particular archive is guaranteed to crash every deployment.
Remediation
Upgrade the API server to Kubeflow Pipelines 2.18.0. Versions through 2.17.3 are affected; the first affected release has not been established.
PR #14171 bounds compressed input and extracted pipeline data. PR #14186 strengthens the total tar traversal budget, including metadata and skipped entries. The 2.18 release also includes configurable upload and specificat…
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- REDHAT Red Hat
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com