The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.
CVSS Rating: [CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) (Medium)

The Kubelet has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.

### Am I vulnerable?

If an attacker can make a request to an unpatched kubelet, then you may be vulnerable to this.

#### Affected Versions

- kubelet v1.17.0 - v1.17.2
- kubelet v1.16.0 - v1.16.6
- kubelet v1.15.0 - v1.15.9

### How do I mitigate this vulnerability?

Limit access to the Kubelet API or patch the Kubelet.

#### Fixed Versions

- v1.17.3
- v1.16.7
- v1.15.10

To upgrade, refer to the documentation: https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster

#### Acknowledgements

This vulnerability was reported by: Henrik Schmidt

/area security
/kind bug
/committee product-security
/sig node
/area kubelet
CVE-2020-8551: Kubelet DoS via API
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CVE-2020-8551: Kubelet DoS via API
Issue date:

--- start body ---
CVSS Rating: [CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) (Medium)

The Kubelet has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.

### Am I vulnerable?

If an attacker can make a request to an unpatched kubelet, then you may be vulnerable to this.

#### Affected Versions

- kubelet v1.17.0 - v1.17.2
- kubelet v1.16.0 - v1.16.6
- kubelet v1.15.0 - v1.15.9

### How do I mitigate this vulnerability?

Limit access to the Kubelet API or patch the Kubelet.

#### Fixed Versions

- v1.17.3
- v1.16.7
- v1.15.10

To upgrade, refer to the documentation: https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster

#### Acknowledgements

This vulnerability was reported by: Henrik Schmidt

/area security
/kind bug
/committee product-security
/sig node
/area kubelet
--- end body ---
