PT-2019-4310 · Kubernetes+1 · Kubernetes Api Server+1

Raesene + 1 · Published 2019-01-18 · Updated 2026-02-24 · CVE-2019-11253

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Kubernetes API server versions v1.0 through v1.12 Kubernetes API server versions prior to v1.13.12 Kubernetes API server versions prior to v1.14.8 Kubernetes API server versions prior to v1.15.5 Kubernetes API server versions prior to v1.16.2

Description The issue is caused by improper input validation in the Kubernetes API server, allowing authorized users to send malicious YAML or JSON payloads. This can cause the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. In versions prior to v1.14.0, the default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility. The vulnerability can be exploited through the API endpoint, allowing attackers to send malicious payloads, such as a "Billion Laughs" attack, which is a type of XML parsing issue that can cause excessive CPU usage.

Recommendations For versions v1.0 through v1.12, update to a version prior to v1.13.12, v1.14.8, v1.15.5, or v1.16.2 to resolve the issue. For versions prior to v1.13.12, update to version v1.13.12 or later to resolve the issue. For versions prior to v1.14.8, update to version v1.14.8 or later to resolve the issue. For versions prior to v1.15.5, update to version v1.15.5 or later to resolve the issue. For versions prior to v1.16.2, update to version v1.16.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the API server to minimize the risk of exploitation. Avoid using the k8s.io/apimachinery/pkg/runtime/serializer/json and k8s.io/apimachinery/pkg/util/json packages until the issue is resolved.

Exploit

Fix

RCE

XML Entity Expansion

Weakness Enumeration

CWE-20

CWE-776

Related Identifiers

ALT-PU-2019-1074

ALT-PU-2019-3354

ALT-PU-2020-1675

BDU:2020-00025

CVE-2019-11253

GHSA-74FP-R6JW-H4MP

GHSA-PMQP-H87C-MR78

GO-2022-0703

GO-2022-0965

OPENSUSE-SU-2024:10901-1

OPENSUSE-SU-2025:15424-1

RHSA-2019:3132

RHSA-2019:3239

RHSA-2019:3811

RHSA-2019:3905

RHSA-2020:2795

RHSA-2020:2796

RHSA-2020:2799

RHSA-2020:2861

RHSA-2020:2863

RHSA-2020:2870

Affected Products

Alt Linux

Kubernetes Api Server

References · 83

• 🔥 https://github.com/kubernetes/kubernetes/issues/83253 · Exploit
• https://osv.dev/vulnerability/GHSA-pmqp-h87c-mr78 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11253 · Security Note
• https://access.redhat.com/errata/RHSA-2019:3811 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2019-4816.html · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0703 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-74fp-r6jw-h4mp · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15424-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11253 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11253 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00025 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-11253 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3239 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3905 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0965 · Vendor Advisory