Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

x/vulndb: potential Go vuln in k8s.io/kubernetes: GHSA-q4rr-64r9-fwgf #1946

Closed
GoVulnBot opened this issue Jul 19, 2023 · 5 comments
Closed

x/vulndb: potential Go vuln in k8s.io/kubernetes: GHSA-q4rr-64r9-fwgf #1946

GoVulnBot opened this issue Jul 19, 2023 · 5 comments
Assignees
@neild
Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.

Comments

@GoVulnBot
Copy link

In GitHub Security Advisory GHSA-q4rr-64r9-fwgf, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
k8s.io/kubernetes 1.13.4 >= 1.13.0, <= 1.13.3

Cross references:

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: k8s.io/kubernetes
      versions:
        - introduced: TODO (earliest fixed "1.13.4", vuln range ">= 1.13.0, <= 1.13.3")
      vulnerable_at: 1.27.4
      packages:
        - package: k8s.io/kubernetes
    - module: k8s.io/kubernetes
      versions:
        - introduced: TODO (earliest fixed "1.12.6", vuln range ">= 1.12.0, <= 1.12.5")
      vulnerable_at: 1.27.4
      packages:
        - package: k8s.io/kubernetes
    - module: k8s.io/kubernetes
      versions:
        - introduced: TODO (earliest fixed "1.11.8", vuln range ">= 1.11.0, <= 1.11.7")
      vulnerable_at: 1.27.4
      packages:
        - package: k8s.io/kubernetes
    - module: k8s.io/kubernetes
      versions:
        - introduced: TODO (earliest fixed "", vuln range ">= 1.0, <= 1.10")
      vulnerable_at: 1.27.4
      packages:
        - package: k8s.io/kubernetes
summary: Kubernetes DoS Vulnerability
description: |-
    In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that
    are authorized to make patch requests to the Kubernetes API Server can send a
    specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json`
    or `"Content-Type: application/json-patch+json"`) that consumes excessive
    resources while processing, causing a Denial of Service on the API Server.
cves:
    - CVE-2019-1002100
ghsas:
    - GHSA-q4rr-64r9-fwgf
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2019-1002100
    - report: https://github.com/kubernetes/kubernetes/issues/74534
    - web: https://access.redhat.com/errata/RHSA-2019:1851
    - web: https://access.redhat.com/errata/RHSA-2019:3239
    - web: https://groups.google.com/forum/#!topic/kubernetes-announce/vmUUNkYfG9g
    - web: https://security.netapp.com/advisory/ntap-20190416-0002/
    - web: https://web.archive.org/web/20210125011246/https://www.securityfocus.com/bid/107290/
    - advisory: https://github.com/advisories/GHSA-q4rr-64r9-fwgf
@neild neild self-assigned this Jul 25, 2023
@neild neild added the excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module. label Jul 25, 2023
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/513195 mentions this issue: data/excluded: batch add 26 excluded reports

This was referenced Jul 26, 2023
Closed
Closed
@GoVulnBot GoVulnBot mentioned this issue Nov 1, 2023
Closed
This was referenced Nov 10, 2023
Closed
Closed
@GoVulnBot GoVulnBot mentioned this issue Apr 23, 2024
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

@GoVulnBot GoVulnBot mentioned this issue Jul 18, 2024
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/606788 mentions this issue: data/reports: unexclude 20 reports (8)

gopherbot pushed a commit that referenced this issue Aug 20, 2024
@tatianab @gopherbot
data/reports: unexclude 20 reports (8)
Loading
Loading status checks…
adfc865 
  - data/reports/GO-2023-1912.yaml
  - data/reports/GO-2023-1915.yaml
  - data/reports/GO-2023-1919.yaml
  - data/reports/GO-2023-1922.yaml
  - data/reports/GO-2023-1924.yaml
  - data/reports/GO-2023-1925.yaml
  - data/reports/GO-2023-1927.yaml
  - data/reports/GO-2023-1928.yaml
  - data/reports/GO-2023-1931.yaml
  - data/reports/GO-2023-1932.yaml
  - data/reports/GO-2023-1936.yaml
  - data/reports/GO-2023-1938.yaml
  - data/reports/GO-2023-1939.yaml
  - data/reports/GO-2023-1940.yaml
  - data/reports/GO-2023-1942.yaml
  - data/reports/GO-2023-1945.yaml
  - data/reports/GO-2023-1946.yaml
  - data/reports/GO-2023-1948.yaml
  - data/reports/GO-2023-1950.yaml
  - data/reports/GO-2023-1952.yaml

Updates #1912
Updates #1915
Updates #1919
Updates #1922
Updates #1924
Updates #1925
Updates #1927
Updates #1928
Updates #1931
Updates #1932
Updates #1936
Updates #1938
Updates #1939
Updates #1940
Updates #1942
Updates #1945
Updates #1946
Updates #1948
Updates #1950
Updates #1952

Change-Id: Id25f09c8f7270af68238752db96d6a399b91ef36
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/606788
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/607375 mentions this issue: data/reports: update GO-2023-1946

gopherbot pushed a commit that referenced this issue Aug 21, 2024
@tatianab @gopherbot
data/reports: update GO-2023-1946
Loading
Loading status checks…
3111a49 
Fix error in affected versions.

  - data/reports/GO-2023-1946.yaml

Updates #1946

Change-Id: I6d2d7b61c6a70fa7ee7a6bb9a77fea54c2ca7c54
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/607375
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/607456 mentions this issue: data/reports: update 6 reports

gopherbot pushed a commit that referenced this issue Aug 21, 2024
@tatianab @gopherbot
data/reports: update 6 reports
Loading
Loading status checks…
37e2de0 
Fix reports which won't pass an upcoming lint check
by merging / collapsing their version ranges.

  - data/reports/GO-2022-0617.yaml
  - data/reports/GO-2023-1573.yaml
  - data/reports/GO-2023-1574.yaml
  - data/reports/GO-2023-1730.yaml
  - data/reports/GO-2023-1946.yaml
  - data/reports/GO-2024-2784.yaml

Updates #617
Updates #1573
Updates #1574
Updates #1730
Updates #1946
Updates #2784

Change-Id: If02308deccab77b00cf10cb3619263e456d1ea64
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/607456
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
@GoVulnBot GoVulnBot mentioned this issue Nov 22, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue Feb 13, 2025
Closed
@GoVulnBot GoVulnBot mentioned this issue Mar 13, 2025
Open
@GoVulnBot GoVulnBot mentioned this issue Mar 21, 2025
Open
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees

@neild neild

Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@neild @gopherbot @GoVulnBot