PT-2020-20203 · Kubernetes+1 · Kubernetes+1

Henrik Schmidt · Published 2020-03-23 · Updated 2025-08-08 · CVE-2020-8551

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Kubernetes versions 1.15.0 through 1.15.9 Kubernetes versions 1.16.0 through 1.16.6 Kubernetes versions 1.17.0 through 1.17.2

Description The Kubelet component has been found to be vulnerable to a denial of service attack via the kubelet API. This includes the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250. The issue is related to allocation of resources without limits or throttling and uncontrolled memory allocation.

Recommendations For versions 1.15.0 through 1.15.9, consider disabling access to the unauthenticated HTTP read-only API on port 10255 and the authenticated HTTPS API on port 10250 until a patch is available. For versions 1.16.0 through 1.16.6, restrict access to the kubelet API to minimize the risk of exploitation. For versions 1.17.0 through 1.17.2, avoid using the kubelet API for critical operations until the issue is resolved. As a temporary workaround, consider implementing resource limits and throttling to prevent uncontrolled memory allocation.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-789

CWE-770

Related Identifiers

ALT-PU-2020-1662

ALT-PU-2020-2338

CVE-2020-8551

GHSA-QHM4-JXV7-J9PQ

GO-2022-0867

OPENSUSE-SU-2025:15424-1

RHSA-2020:1276

Affected Products

Alt Linux

Kubernetes

References · 63

• https://github.com/kubernetes/kubernetes/issues/89377 · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-8551 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0867 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15424-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qhm4-jxv7-j9pq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8551 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8551 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-8551 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX · Vendor Advisory
• https://github.com/kubernetes/kubernetes/commit/9802bfcec0580169cffce2a3d468689a407fa7dc · Note
• https://github.com/kubernetes/kubernetes/pull/87913 · Note
• https://suse.com/security/cve/CVE-2020-8551 · Note
• https://suse.com/security/cve/CVE-2023-2728 · Note
• https://suse.com/security/cve/CVE-2018-1002101 · Note