CVE-2020-8552: fedoraproject fedora
CVSS: 5.3v3.1MediumModified
AliasesRHBA-2020:0929RHBA-2020:2215RHSA-2020:1527UBUNTU-CVE-2020-8552DEBIAN-CVE-2020-8552CGA-3rjw-mw6c-7p5rCGA-4q7w-rrpm-3rqqCGA-57fq-qfhr-3997CGA-5rqv-m76v-2jq4CGA-6vrx-jvwc-22vfCGA-6wgp-v6vv-8r4hCGA-7f79-p3xh-28vvCGA-8rf9-95rf-74r6CGA-9j43-mq8r-c4fxCGA-9jwg-cm5w-jj3rCGA-c8vm-ch42-cwp5CGA-g94c-v4p9-xpfgCGA-ghgf-8wp8-6g6gCGA-gj7m-gh44-5w8hCGA-gw44-8688-9f9vCGA-j299-r5fh-wxw7CGA-p77c-wp6h-8cv6CGA-qwjf-6xqr-qgf6CGA-r8r9-93gr-w4p9CGA-rfj2-383w-376rCGA-v378-jf67-wgqqCGA-wfg2-5x37-cqg3CGA-whx5-fxxw-fmgrCGA-xp9m-rx3g-4rcqGHSA-82hx-w2r5-c2wqCGA-3g66-x8fg-4574CGA-3jpf-f473-jjgmCGA-6rh8-93r8-3jfwCGA-rjpr-g56q-hccf
Published 27-03-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-8552 is a medium (CVSS 5.3) vulnerability in fedoraproject fedora. EPSS estimates a 2.41% chance of exploitation in the next 30 days, higher than 83.8% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)EPSS score
2.41%
0%100%
Low · -0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 34RHSA-2020:2992CGA-2FWG-FXGV-VQ96CGA-2WMC-7FJ8-83FJCGA-3FGG-XF25-J5HVCGA-3X45-7MR2-XXQ2CGA-59R3-XPJV-F645CGA-5HWQ-FQV8-3GWCCGA-684P-QWMC-V2WGCGA-6C3M-PQW8-W2Q4CGA-8292-W3FF-H7PFCGA-8H3F-5V3C-GC9GCGA-8WX7-FM9G-94XFCGA-9FJ5-95WQ-FVV4CGA-9FQ6-95J8-79Q5CGA-9P7V-FWG2-4G8FCGA-CMXM-53XG-9V7MCGA-F6PV-V4QG-GRM7CGA-FF8X-6Q32-QHC8CGA-GCHG-Q3X4-35Q6CGA-GHH6-75V8-G2MQCGA-GW6R-3J9J-6G3JCGA-HG82-CW92-RC93CGA-HH36-8GCC-WCQ3CGA-HVQ4-5JWW-X56RCGA-J34C-J5XC-VJJMCGA-M55X-PC5W-253GCGA-M8C9-6V82-3CFRCGA-MQMV-HJHR-5875CGA-P76G-P9PF-XX29CGA-PJGC-H224-2WGWCGA-QM67-J97V-FVQXCGA-QPQF-PJ9C-WMF6CGA-R64G-VFX4-P762CGA-RX6M-PX3X-VP8QCGA-WFRF-XFJX-JG4V
Timeline
- 27-03-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.
CVSS metrics
9 scores · 8 sources · 2 versionsMedium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSources8 sources · 4.3–5.3
- OSV · Red hatEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · DebianEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · WolfiEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · GoEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · ChainguardEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
Medium 4.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
2.41%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
-0.02 pp
From 2.43% on 19-09-2026
19-09-202619-10-2026
EPSS score2.41%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Redhat42 products
- atomic-enterprise-service-catalog< 1:3.11.219-1.git.1.717017c.el7
- atomic-enterprise-service-catalog-svcat< 1:3.11.219-1.git.1.717017c.el7
- atomic-openshift< 0:3.11.219-1.git.0.0c21387.el7
- atomic-openshift-clients< 0:3.11.219-1.git.0.0c21387.el7
- atomic-openshift-clients-redistributable< 0:3.11.219-1.git.0.0c21387.el7
Chainguard14 products
- aws-ebs-csi-driverAll versions (No fix recorded)
- flux-helm-controllerAll versions (No fix recorded)
- haproxy-ingressAll versions (No fix recorded)
- helmAll versions (No fix recorded)
- helm-3All versions (No fix recorded)
Wolfi12 products
- flux-helm-controllerAll versions (No fix recorded)
- haproxy-ingressAll versions (No fix recorded)
- helmAll versions (No fix recorded)
- helm-3All versions (No fix recorded)
- helm-4All versions (No fix recorded)
Debian1 product
- kubernetes< 1.17.4-1
Fedoraproject1 product
- fedoraEOL32
K8s.io1 product
- apiserver< 0.15.10 | ≥ 0.16.0, < 0.16.7 | ≥ 0.17.0, < 0.17.3
Kubernetes1 product
- kubernetes≥ unspecified, < v1.17.3 | ≥ unspecified, < v1.16.7 | ≥ unspecified, < v1.15.10 | ≤ 1.15.9 | ≥ 1.16.0, ≤ 1.16.6 | ≥ 1.17.0, ≤ 1.17.2
Ubuntu1 product
- kubernetesAll versions (No fix recorded)
8 vendors · 73 products
References
39 links- github.com/kubernetes/kubernetes/issues/89378X Refsource MISCARTICLEREPORTFIXWEBIssue TrackingPatchThird Party Advisory
