PT-2023-23656 · Suse · K3S

Highcwayne18 · Published 2023-09-11 · Updated 2023-09-21 · CVE-2023-32187

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions k3s versions 1.24.0 through 1.24.17 k3s versions 1.25.0 through 1.25.13 k3s versions 1.26.0 through 1.26.8 k3s versions 1.27.0 through 1.27.5 k3s versions 1.28.0 through 1.28.1

Description An Allocation of Resources Without Limits or Throttling issue in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6443) to cause denial of service. The issue affects k3s servers, where an attacker can force the TLS server to add entries to the certificate's Subject Alternative Name (SAN) list until the certificate grows so large that it exceeds the maximum size allowed by TLS client implementations, leading to a denial of service (DoS) attack.

Recommendations For versions 1.24.0 through 1.24.17, upgrade to version 1.24.17+k3s1. For versions 1.25.0 through 1.25.13, upgrade to version 1.25.13+k3s1. For versions 1.26.0 through 1.26.8, upgrade to version 1.26.8+k3s1. For versions 1.27.0 through 1.27.5, upgrade to version 1.27.5+k3s1 and add the parameter tls-san-security: true to the K3s configuration. For versions 1.28.0 through 1.28.1, upgrade to version 1.28.1+k3s1. If you cannot upgrade to a fixed release, consider running the command kubectl annotate secret -n kube-system k3s-serving listener.cattle.io/static=true to "freeze" the certificate, but be aware that this will prevent the certificate from adding new SAN entries and automatically renewing itself.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2023-32187

GHSA-M4HF-6VGR-75R2

Affected Products

K3S

References · 9

• https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m4hf-6vgr-75r2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32187 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32187 · Vendor Advisory
• https://github.com/k3s-io/k3s · Note
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32187https: · Note
• https://t.me/cvenotify/58316 · Telegram Post
• https://twitter.com/cracbot/status/1704012490433331565 · Twitter Post
• https://twitter.com/CVEnew/status/1703748028094439605 · Twitter Post