Description
The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.
References (4)
Scores
CVSS v3
4.3
EPSS
0.0062
EPSS Percentile
70.0%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Details
CWE
CWE-770
CWE-789
Status
published
Products (3)
fedoraproject/fedora
32
k8s.io/kubernetes
1.15.0 - 1.15.10Go
kubernetes/kubernetes
1.15.0 - 1.15.9
Published
Mar 27, 2020
Tracked Since
Feb 18, 2026