CVE-2022-31074mediumCWE-400

CVE-2022-31074: fallo de gravedad media en kubeedge

KubeEdge Cloud AdmissionController component DoS

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear kubeedge+ Monitorear github.com/kubeedge/kubeedge

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.5epss 0.8%
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, several endpoints in the Cloud AdmissionController may be susceptible to a DoS attack if an HTTP request containing a very large Body is sent to it. The consequence of the exhaustion is that the Cloud AdmissionController will be in denial of service. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. There is currently no known workaround.
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Productos afectados
kubeedge · kubeedge
CVEs relacionadas — kubeedge

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-31073MEDIUMKubeEdge Edge ServiceBus module DoSEPSS 1.7%CVE-2022-31075MEDIUMKubeEdge DoS when signing the CSR from EdgeCoreEPSS 1.0%CVE-2022-31077MEDIUMMalicious response from KubeEdge can crash CSI Driver controller serverEPSS 0.8%CVE-2022-31080MEDIUMKubeEdge Websocket Client in package Viaduct: DoS from large response messageEPSS 0.7%CVE-2022-31079MEDIUMKubeEdge Cloud Stream and Edge Stream DoS from large stream messageEPSS 0.7%CVE-2022-31078MEDIUMKubeEdge CloudCore Router memory exhaustionEPSS 0.7%