VDB
RHSA-2020%3A0933
RHSA-2020%3A0933
PUBLISHED
CVSS 6.5 MEDIUM
The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-openshift-apiserver-rhel7@sha256:1bebc10fd956168ec31e45ce2d3753f215b59a533c834d41c6f83eca4db2da84_amd64 as a component of Red Hat OpenShift Container Platform 4.3 | * |
Timeline
- Apr 1, 2020 CVE Published
- Mar 27, 2026 CVE Updated
- Apr 30, 2026 Distribution Patch
- Apr 30, 2026 Distribution Patch
- Apr 30, 2026 Security Advisory
- Apr 30, 2026 Security Advisory
- Apr 30, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2020:0933 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1797909 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0933.json advisory
- https://access.redhat.com/security/cve/CVE-2019-11254 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1819486 issue
- https://www.cve.org/CVERecord?id=CVE-2019-11254 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-11254 advisory
- https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc advisory
- https://access.redhat.com/security/cve/CVE-2020-8552 advisory
- https://www.cve.org/CVERecord?id=CVE-2020-8552 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-8552 advisory
- https://github.com/kubernetes/kubernetes/issues/89378 advisory
- https://groups.google.com/forum/#!topic/kubernetes-security-announce/2UOlsba2g0s advisory