Loading vulnerability…
Kubernetes API Server Denial of Service via JSON Patch
CVE-2019-1002100 is a resource-exhaustion vulnerability in the Kubernetes API Server's processing of JSON Patch requests. A user authorized to perform patch operations can submit a specially crafted request with the application/json-patch+json content type that consumes excessive server resources, causing denial of service. Affected releases include Kubernetes 1.11 before 1.11.8, 1.12 before 1.12.6, 1.13 before 1.13.4, and earlier release branches.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authorized user with patch permissions can exhaust API Server resources, degrading or interrupting Kubernetes API availability and potentially disrupting cluster management and control-plane operations. This vulnerability does not establish code execution, privilege escalation, or data disclosure.
If you can’t patch tonight, do this now.
Until an upgrade is possible, remove patch permissions from untrusted users and service accounts. Review API authorization policies and restrict patch operations to trusted principals to reduce exposure to malicious JSON Patch requests.
Patch, then assume compromise.
Upgrade to Kubernetes 1.11.8, 1.12.6, or 1.13.4 or later, as appropriate for the release branch. Older affected branches should be upgraded to a supported, fixed release. For vendor-managed distributions, obtain a release containing the fix from the distribution vendor.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.