This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-11254 →

DEBIAN-CVE-2019-11254

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicio...

Original description

The description as published by the source.

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 kubernetes

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.4-1"}]}]

Debian:13 kubernetes

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.4-1"}]}]

Debian:14 kubernetes

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.4-1"}]}]

References

advisory security-tracker.debian.org