Skip to content
Fencer Vulns
medium 5.3

CVE-2020-8552 json

Kubernetes API server denial of service

published 2020-03-27 6 y ago modified 2026-09-10 1 mo ago also GHSA-82hx-w2r5-c2wq , EUVD-2022-0898

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.8%
EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.

Patch / fix

  • go k8s.io/apiserver 0.15.10, 0.16.7, 0.17.3
  • Kubernetes Kubernetes v1.15.10, v1.16.7, v1.17.3
  • kubernetes Debian 14, Debian 13, Debian 12 1.17.4-1

debian advisories DEBIAN-CVE-2020-8552

  • cri-o openshift 3.11 1.11.16-0.10.dev.rhaos3.11.git1eee681.el7
  • atomic-openshift openshift 3.11 3.11.248-1.git.0.92ee8ac.el7
  • atomic-openshift-pod openshift 3.11 3.11.248-1.git.0.92ee8ac.el7
  • atomic-openshift-node openshift 3.11 3.11.248-1.git.0.92ee8ac.el7
  • atomic-openshift-tests openshift 3.11 3.11.248-1.git.0.92ee8ac.el7
  • atomic-openshift-master openshift 3.11 3.11.248-1.git.0.92ee8ac.el7
  • atomic-openshift-clients openshift 3.11 3.11.248-1.git.0.92ee8ac.el7
  • atomic-openshift-sdn-ovs openshift 3.11 3.11.248-1.git.0.92ee8ac.el7

red hat advisories RHSA-2020:2992RHBA-2020:2215RHSA-2020:1527RHBA-2020:0929

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-8552 updated cvss 4.3

kubernetes: Use of unbounded 'client' label in apiserver_request_total allows for memory exhaustion

  • Red Hat OpenShift Container Platform 4 openshift4/ose-hypershift, openshift4/ose-service-catalog
    affected: workaround, no fix planned “Prevent unauthenticated or unauthorized access to all APIs”
  • Red Hat OpenShift Container Platform 3.11 prometheus 3.11.219-1.git.1.3f6e657.el7, openshift-kuryr 3.11.219-1.git.1.717d59f.el7, atomic-openshift 3.11.219-1.git.0.0c21387.el7, atomic-openshift 3.11.248-1.git.0.92ee8ac.el7, openshift-ansible 3.11.219-1.git.0.8845382.el7, openshift-kuryr-cni 3.11.219-1.git.1.717d59f.el7, +46 more
    fixed: vendor fix “Prevent unauthenticated or unauthorized access to all APIs” RHBA-2020:2215
  • Red Hat OpenShift Container Platform 4.2 openshift4/ose-hyperkube v4.2.29-202004140532, openshift 4.2.29-202004110432.git.0.f7d02c8.el8, openshift 4.2.29-202004120346.git.0.d948116.el7, openshift-hyperkube 4.2.29-202004110432.git.0.f7d02c8.el8, openshift-hyperkube 4.2.29-202004120346.git.0.d948116.el7, openshift4/ose-openshift-apiserver-rhel7 v4.2.34-202005252115
    fixed: vendor fix “Prevent unauthenticated or unauthorized access to all APIs” RHSA-2020:1527
  • Red Hat OpenShift Container Platform 4.3 openshift4/ose-hyperkube v4.3.9-202003230345, openshift 4.3.9-202003230116.git.0.ebf9a26.el7, openshift 4.3.9-202003230116.git.0.ebf9a26.el8, openshift-hyperkube 4.3.9-202003230116.git.0.ebf9a26.el7, openshift-hyperkube 4.3.9-202003230116.git.0.ebf9a26.el8, openshift4/ose-openshift-apiserver-rhel7 v4.3.9-202003230345
    fixed: vendor fix “Prevent unauthenticated or unauthorized access to all APIs” RHBA-2020:0929
  • Red Hat OpenShift Container Platform 4.4 openshift4/ose-cli v4.4.0-202004261927, openshift4/ose-pod v4.4.0-202004261927, openshift4/ose-etcd v4.4.0-202004261927, openshift4/ose-tests v4.4.0-202004261927, openshift4/ose-console v4.4.0-202004261927, openshift4/ose-coredns v4.4.0-202004261927, +76 more
    fixed: vendor fix “Prevent unauthenticated or unauthorized access to all APIs” RHBA-2020:0581
  • Red Hat OpenShift Container Platform 3.11 cri-o 1.11.16-0.10.dev.rhaos3.11.git1eee681.el7, atomic-openshift-web-console 3.11.248-1.git.1.cc96c2d.el7 Red Hat OpenShift Container Platform 4.3 systemd 239-27.el8, ostree 2019.6-2.el8, libnftnl 1.1.5-4.el8, iptables 1.8.4-10.el8, systemd-pam 239-27.el8, rpm-ostree 2019.6-8.el8, +118 more Red Hat Storage 3 heketi, heketi-client, python-heketi
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.84% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
go k8s.io/apiserver
<0.15.10
>=0.16.0, <0.16.7
>=0.17.0, <0.17.3
0.15.10
0.16.7
0.17.3

Affected products

  • Kubernetes Kubernetes

Classification

Weakness
  • CWE-789 Memory Allocation with Excessive Size Value
  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-400 Uncontrolled Resource Consumption
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.