Severe Flaws in Kubernetes Expose All Servers to DoS Attacks

Two severe vulnerabilities affecting all Kubernetes open-source variants for containerized applications can cause a denied-of-service (DoS) state for an unauthorized attacker.

The development team of Kubernetes have already published patched versions to tackle these newly identified safety defects and prevent prospective attackers from using them.

Kubernetes was initially created using Google and is intended to automate containerized workloads and services deployment, scaling and governance across hosts clusters.

This is done through the organization of application containers into pods, nodes, and clusters, with various nodes that form a cluster managed by the Master which co-ordinates duties relating to clusters, such as scale-up, scheduling, or updating applications.

Security defects affect all versions of Kubernetes

“A security issue has been found in the net/http library of the Go language that affects all versions and all components of Kubernetes,” disclosed Kubernetes Product Security Committee’s Micah Hausler on the announcement list for Kubernetes security issues.

“The vulnerabilities can result in a DoS against any process with an HTTP or HTTPS listener,” with all versions of Kubernetes being affected.

Netflix announced on August 13 that it discovered numerous vulnerabilities, which expose servers that promote HTTP/2 communication in DoS attacks.

Of the eight Netflix CVEs, two of them have an impact on Go as well as all Kubernetes ‘ components that are intended to serve HTTP/2 traffic (including /healthz).

CVSS v3.0 baseline values of 7.5 were assigned by the Kubernetes Product security committee to the two weaknesses identified as CVE-2019-9512 and CVE-2019-9514, which enable “untrusted clients to allocate an unlimited amount of memory until the server crashes.”