Log in Start free

Vulnerability · Published Jul 11, 2022 · Assigned by GitHub_M

CVE-2022-31074KubeEdge Cloud AdmissionController component DoS

Medium 4.5

In plain English

A medium-severity uncontrolled resource consumption in kubeedge from kubeedge. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.5Medium
Exploit odds (30 days)0.8%top 42.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, several endpoints in the Cloud AdmissionController may be susceptible to a DoS attack if an HTTP request containing a very large Body is sent to it. The consequence of the exhaustion is that the Cloud AdmissionController will be in denial of service. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. There is currently no known workaround.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/kubeedge/kubeedge1.11.1GHSA-w52j-3457-q9wr
Gogithub.com/kubeedge/kubeedge1.10.2GHSA-w52j-3457-q9wr
Gogithub.com/kubeedge/kubeedge1.9.4GHSA-w52j-3457-q9wr
Gogithub.com/kubeedge/kubeedge1.10.2, 1.11.1, 1.9.4GO-2022-0508

Affected products (as reported)

VendorProductVersions
kubeedge kubeedge < 1.9.4>= 1.10.0, < 1.10.2= 1.11.0

Weakness: CWE-400 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

References