CVE-2022-31074: medium-severity vulnerability in kubeedge
KubeEdge Cloud AdmissionController component DoS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.5epss 0.8%
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, several endpoints in the Cloud AdmissionController may be susceptible to a DoS attack if an HTTP request containing a very large Body is sent to it. The consequence of the exhaustion is that the Cloud AdmissionController will be in denial of service. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. There is currently no known workaround.
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected products
kubeedge · kubeedgeRelated CVEs — kubeedge
In the same product, most dangerous first.
CVE-2022-31073MEDIUMKubeEdge Edge ServiceBus module DoSEPSS 1.7%CVE-2022-31075MEDIUMKubeEdge DoS when signing the CSR from EdgeCoreEPSS 1.0%CVE-2022-31077MEDIUMMalicious response from KubeEdge can crash CSI Driver controller serverEPSS 0.8%CVE-2022-31080MEDIUMKubeEdge Websocket Client in package Viaduct: DoS from large response messageEPSS 0.7%CVE-2022-31079MEDIUMKubeEdge Cloud Stream and Edge Stream DoS from large stream messageEPSS 0.7%CVE-2022-31078MEDIUMKubeEdge CloudCore Router memory exhaustionEPSS 0.7%