-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description states that an attacker can cause a denial of service by sending unbounded responses from either the Elastic service or an extender plugin. The provided commits (e.g., 45a4347471a5254121d10afef04c6732095fa398) show identical patches applied across different versions/branches. These patches introduce http.MaxBytesReader to limit the size of the HTTP response body being read and decoded.
In pkg/scheduler/metrics/source/metrics_client_elasticsearch.go, the function (*ElasticsearchMetricsClient).NodeMetricsAvg is responsible for making requests to Elasticsearch and decoding the response. The patch adds http.MaxBytesReader before json.NewDecoder(res.Body).Decode(&r). This indicates that NodeMetricsAvg was previously vulnerable to unbounded responses from Elasticsearch.
In pkg/scheduler/plugins/extender/extender.go, the function (*extenderPlugin).send is responsible for sending requests to an extender and decoding its response. The patch adds http.MaxBytesReader before json.NewDecoder(resp.Body).Decode(result). This indicates that send was previously vulnerable to unbounded responses from the extender plugin.
Both functions directly handle HTTP responses from external services (Elasticsearch and extender plugins) and were modified to limit the response size, which is the core of the described vulnerability. Therefore, these are the functions that would be involved when the vulnerability is triggered.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| volcano.sh/volcano | go | < 1.9.1 | 1.9.1 |
| volcano.sh/volcano | go | >= 1.10.0-alpha.0, < 1.10.2 | 1.10.2 |
| volcano.sh/volcano | go | >= 1.11.0-network-topology-preview.0, < 1.11.0-network-topology-preview.3 | 1.11.0-network-topology-preview.3 |
| volcano.sh/volcano | go | >= 1.11.0, < 1.11.2 | 1.11.2 |
| volcano.sh/volcano | go | >= 1.12.0-alpha.0, < 1.12.0-alpha.2 | 1.12.0-alpha.2 |