Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-11253 — Improper Input Validation in Kubernetes

CWE-20 — Improper Input ValidationCWE-776 — XML Entity ExpansionCWE-400 — Uncontrolled Resource Consumption13 documents8 sources
Severity
7.5HIGHNVD
EPSS
83.8%
top 0.71%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
4
KubernetesK8s.io ApimachineryK8s.io Kubernetes+1 more
Timeline
PublishedOct 17
Latest updateAug 21

Description

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more per…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶Gok8s.io/kubernetes1.0.0 — 1.13.12+3
▶NVDkubernetes/kubernetes1.13.0 — 1.13.12+4
▶Debiankubernetes/kubernetes< 1.17.4-1+3
▶CVEListV5kubernetes/kubernetes16 versions+15
▶Gok8s.io/apimachinery< 0.0.0-20190927203648-9ce6eca90e73

Also affects: Openshift Container Platform 3.10, 3.11, 3.9

🔴Vulnerability Details

7
OSV
XML Entity Expansion and Improper Input Validation in Kubernetes API server in k8s.io/kubernetes↗2024-08-21
▶
OSV
Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing↗2023-02-08
▶
GHSA
Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing↗2023-02-08
▶
OSV
XML Entity Expansion and Improper Input Validation in Kubernetes API server↗2021-05-18
▶
GHSA
XML Entity Expansion and Improper Input Validation in Kubernetes API server↗2021-05-18
▶

💥Exploits & PoCs

1
Nuclei
Kubernetes API Server - YAML Parsing DoS (Billion Laughs)
▶

📋Vendor Advisories

2
Red Hat
kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service↗2019-09-28
▶
Debian
CVE-2019-11253: kubernetes - Improper input validation in the Kubernetes API server in versions v1.0-1.12 and...↗2019
▶

💬Community

2
Bugzilla
CVE-2019-11253 kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service [fedora-all]↗2019-10-02
▶
Bugzilla
CVE-2019-11253 kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service↗2019-10-02
▶
CVE-2019-11253 — Improper Input Validation | cvebase