description: In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.
problem types: Uncontrolled Resource Consumption
affected:
{
product: Kubernetes
vendor: Kubernetes
versions:
status: affected, version: v1.0.x
status: affected, version: v1.1.x
status: affected, version: v1.2.x
status: affected, version: v1.3.x
status: affected, version: v1.4.x
status: affected, version: v1.5.x
status: affected, version: v1.6.x
status: affected, version: v1.7.x
status: affected, version: v1.8.x
status: affected, version: v1.9.x
status: affected, version: v1.10.x
lessThan: v1.11.8, status: affected, version: unspecified, versionType: custom
lessThan: v1.12.6, status: affected, version: unspecified, versionType: custom
lessThan: v1.13.4, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.0
]