The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.
CVE-2019-11254 is a denial of service vulnerability in the kube-apiserver, allowing authorized users sending malicious YAML payloads to cause kube-apiserver to consume excessive CPU cycles while parsing YAML.
 
The issue was discovered via the fuzz test kubernetes/kubernetes#83750.
 
**Affected components:**
Kubernetes API server
 
**Affected versions:**
<= v1.15.9, resolved in 1.15.10 by https://github.com/kubernetes/kubernetes/pull/87640
v1.16.0-v1.16.7, resolved in 1.16.8 by https://github.com/kubernetes/kubernetes/pull/87639
v1.17.0-v1.17.2, resolved in 1.17.3 by https://github.com/kubernetes/kubernetes/pull/87637
Fixed in master by https://github.com/kubernetes/kubernetes/pull/87467
 
**How do I mitigate this vulnerability?**
Prior to upgrading, these vulnerabilities can be mitigated by preventing unauthenticated or unauthorized access to kube-apiserver.
CVE-2019-11254: kube-apiserver Denial of Service vulnerability from malicious YAML payloads
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CVE-2019-11254: kube-apiserver Denial of Service vulnerability from malicious YAML payloads
Issue date:

--- start body ---
CVE-2019-11254 is a denial of service vulnerability in the kube-apiserver, allowing authorized users sending malicious YAML payloads to cause kube-apiserver to consume excessive CPU cycles while parsing YAML.
 
The issue was discovered via the fuzz test kubernetes/kubernetes#83750.
 
**Affected components:**
Kubernetes API server
 
**Affected versions:**
<= v1.15.9, resolved in 1.15.10 by https://github.com/kubernetes/kubernetes/pull/87640
v1.16.0-v1.16.7, resolved in 1.16.8 by https://github.com/kubernetes/kubernetes/pull/87639
v1.17.0-v1.17.2, resolved in 1.17.3 by https://github.com/kubernetes/kubernetes/pull/87637
Fixed in master by https://github.com/kubernetes/kubernetes/pull/87467
 
**How do I mitigate this vulnerability?**
Prior to upgrading, these vulnerabilities can be mitigated by preventing unauthenticated or unauthorized access to kube-apiserver.
--- end body ---
