{
  "threat_severity" : "Moderate",
  "public_date" : "2020-03-27T00:00:00Z",
  "bugzilla" : {
    "description" : "kubernetes: Denial of service in API server via crafted YAML payloads by authorized users",
    "id" : "1819486",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1819486"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-400",
  "details" : [ "The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML." ],
  "statement" : "The upstream Kubernetes fix for this vulnerability is to update the version of the Go dependency, gopkg.in/yaml.v2. This issue affects OpenShift Container Platform components that use versions before 2.2.8 of gopkg.in/yaml.v2 and accept YAML payloads.",
  "affected_release" : [ {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "release_date" : "2020-06-18T00:00:00Z",
    "advisory" : "RHSA-2020:2479",
    "cpe" : "cpe:/a:redhat:openshift:3.11::el7",
    "package" : "atomic-openshift-0:3.11.232-1.git.0.a5bc32f.el7"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.3",
    "release_date" : "2020-04-01T00:00:00Z",
    "advisory" : "RHSA-2020:0933",
    "cpe" : "cpe:/a:redhat:openshift:4.3::el7",
    "package" : "openshift4/ose-openshift-apiserver-rhel7:v4.3.9-202003230345"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.5",
    "release_date" : "2020-07-13T00:00:00Z",
    "advisory" : "RHSA-2020:2412",
    "cpe" : "cpe:/a:redhat:openshift:4.5::el7",
    "package" : "openshift4/ose-hyperkube:v4.5.0-202007100518.p0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.5",
    "release_date" : "2020-07-13T00:00:00Z",
    "advisory" : "RHSA-2020:2412",
    "cpe" : "cpe:/a:redhat:openshift:4.5::el7",
    "package" : "openshift4/ose-oauth-server-rhel7:v4.5.0-202007012112.p0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.5",
    "release_date" : "2020-07-13T00:00:00Z",
    "advisory" : "RHSA-2020:2413",
    "cpe" : "cpe:/a:redhat:openshift:4.5::el7",
    "package" : "openshift-0:4.5.0-202007012112.p0.git.0.582d7fc.el7"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Will not fix",
    "package_name" : "openshift4/ose-hypershift",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-k8s-prometheus-adapter",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-oauth-server-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-openshift-state-metrics-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Will not fix",
    "package_name" : "openshift4/ose-service-catalog",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2019-11254\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-11254\nhttps://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc" ],
  "name" : "CVE-2019-11254",
  "mitigation" : {
    "value" : "Prevent unauthenticated or unauthorized access to the API server",
    "lang" : "en:us"
  },
  "csaw" : false
}