-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| k8s.io/kubernetes | go | >= 1.0, <= 1.10 | |
| k8s.io/kubernetes | go | >= 1.11.0, <= 1.11.7 | 1.11.8 |
| k8s.io/kubernetes | go | >= 1.12.0, <= 1.12.5 | 1.12.6 |
| k8s.io/kubernetes | go | >= 1.13.0, <= 1.13.3 | 1.13.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from uncontrolled resource consumption during JSON-patch processing. The kube-apiserver's patch handler (patch.go) uses the evanphx/json-patch library to apply patches. Prior to fixes in 1.11.8/1.12.6/1.13.4, these functions didn't validate() the number of operations or complexity of JSON-patch requests, allowing specially crafted payloads to trigger excessive CPU/memory usage. The CWE-770 classification confirms this is a resource allocation flaw, and the GitHub advisory explicitly implicates the JSON-patch handling flow.