CVE-2019-1002100
Kubernetes DoS Vulnerability
Reported by dwf · Published April 1, 2019
k8s.io/kubernetes is fixed in 1.13.4, 1.12.6, 1.11.8 and 1 more (Go Modules)
In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| k8s.io/kubernetes | Go Modules | 1.13.4, 1.12.6, 1.11.8, 1.10.14 |
| kubernetes | kubernetes | 1.13.4, 1.12.6, 1.11.8 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Kubernetes | Kubernetes | v1.0.x, v1.1.x, v1.2.x |
| wolfi | kubeflow-pipelines | * |
| k8s.io | kubernetes | 1.12.0, 1.13.0, 1.0.0 |
| Kubernetes | Kubernetes | 1.4.x, 1.5.x, 1.6.x |
| chainguard | kubeflow-pipelines | * |
Timeline
- Apr 1, 2019 CVE Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- Nov 21, 2024 CVE Updated
- Mar 17, 2026 Security Advisory (3 in total, the first dated here)
- Sep 17, 2026 Coalition ESS Score
- Oct 31, 2026 Distribution Patch (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2019-1002100
vulnetix vdb fixes CVE-2019-1002100Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2019-1002100/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- 107290 vdb-entryx_refsource_BID
- x_refsource_CONFIRM
- x_refsource_CONFIRM
- x_refsource_CONFIRM
- RHSA-2019:1851 vendor-advisoryx_refsource_REDHAT
- RHSA-2019:3239 vendor-advisoryx_refsource_REDHAT
- https://github.com/kubernetes/kubernetes url
- https://nvd.nist.gov/vuln/detail/CVE-2019-1002100 advisory
- https://github.com/advisories/GHSA-q4rr-64r9-fwgf advisory
- https://groups.google.com/forum/#!topic/kubernetes-announce/vmUUNkYfG9g url
- https://security.netapp.com/advisory/ntap-20190416-0002 advisory
- https://web.archive.org/web/20210125011246/https://www.securityfocus.com/bid/107290 url