Vulnerability · Published Mar 27, 2020 · Assigned by kubernetes
CVE-2020-8552Kubernetes API server denial of service
Medium 5.3
In plain English
A medium-severity security flaw in Kubernetes from Kubernetes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)2.8%top 13.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | kubernetes | 1.17.4-1 | DEBIAN-CVE-2020-8552 |
| Debian:13 | kubernetes | 1.17.4-1 | DEBIAN-CVE-2020-8552 |
| Debian:14 | kubernetes | 1.17.4-1 | DEBIAN-CVE-2020-8552 |
| Go | k8s.io/apiserver | 0.15.10 | GHSA-82hx-w2r5-c2wq |
| Go | k8s.io/apiserver | 0.16.7 | GHSA-82hx-w2r5-c2wq |
| Go | k8s.io/apiserver | 0.17.3 | GHSA-82hx-w2r5-c2wq |
| Ubuntu:22.04:LTS | kubernetes | no fix listed | UBUNTU-CVE-2020-8552 |
| Ubuntu:24.04:LTS | kubernetes | no fix listed | UBUNTU-CVE-2020-8552 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kubernetes | Kubernetes | unspecified – before v1.17.3unspecified – before v1.16.7unspecified – before v1.15.10 |
Weakness: CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://groups.google.com/forum/#%21topic/kubernetes-security-announce/2UOlsba2g0s x_refsource_MISC
- https://github.com/kubernetes/kubernetes/issues/89378 x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20200413-0003/ x_refsource_CONFIRM
- FEDORA-2020-aeea04cd13 vendor-advisory, x_refsource_FEDORA