| Package | Affected versions | Patched versions |
|---|---|---|
| k8s.io/kubernetes | ≥ 1.0.0, ≤ 1.10.14≥ 1.0.0, < 1.11.8≥ 1.11.0, < 1.11.8≥ 1.12.0, < 1.12.6≥ 1.13.0, < 1.13.4 | 1.11.81.12.61.13.4 |
| kubernetes | ≥ 1.12.0, < 1.12.6≥ 1.13.0, < 1.13.4< 1.11.8 | 1.12.61.13.41.11.8 |
| openshift container platform | = 3.10= 3.11 |
In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. kubectl patch --type json or "Content-Type: application/json-patch+json") that consumes excessive resources while processing, causing a Denial of Service on the API Server.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free