Log in Start free

Vulnerability · Published Mar 27, 2020 · Assigned by kubernetes

CVE-2020-8551Kubernetes kubelet denial of service

Medium 4.3

In plain English

A medium-severity security flaw in Kubernetes from Kubernetes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)1.2%top 30.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12kubernetes1.17.4-1DEBIAN-CVE-2020-8551
Debian:13kubernetes1.17.4-1DEBIAN-CVE-2020-8551
Debian:14kubernetes1.17.4-1DEBIAN-CVE-2020-8551
Gok8s.io/kubernetes1.15.10GHSA-qhm4-jxv7-j9pq
Gok8s.io/kubernetes1.15.10, 1.16.6, 1.17.2GO-2022-0867
Gok8s.io/kubernetes1.16.6GHSA-qhm4-jxv7-j9pq
Gok8s.io/kubernetes1.17.2GHSA-qhm4-jxv7-j9pq

Affected products (as reported)

VendorProductVersions
Kubernetes Kubernetes unspecified – before v1.17.3unspecified – before v1.16.7unspecified – before v1.15.10

Weakness: CWE-789 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References