| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/go-yaml/yaml | ≤ 2.1.0all versions | |
| gopkg.in/yaml.v2 | < 2.2.8 | 2.2.8 |
| kubernetes | ≥ 1.16.0, < 1.16.7≥ 1.17.0, < 1.17.3< 1.15.10 | 1.16.71.17.31.15.10 |
The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free