[GHSA-82hx-w2r5-c2wq] Kubernetes API Server DoS Via API Requests

[skitt]

Updates

• Affected products

Comments
Go versions of k8s.io artifacts start with 0, see for example https://pkg.go.dev/k8s.io/apiserver?tab=versions. The version corresponding to Kubernetes 1.17.3 is 0.17.3.

[darakian]

Gah, sorry about the error and thanks for the PR. Any chance you have some release notes that correspond with these api server releases? I'm not finding much in their repo.

[skitt]

The corresponding release note was

Removed the 'client' label from apiserver_request_total.

See the PR description in kubernetes/kubernetes#87669. There’s no direct mention of the CVE in the release notes, the CVE was tracked in kubernetes/kubernetes#89378 and versions with fixes are listed there (as Kubernetes versions, not Go module versions).

The note above appears only as a deprecation in the 1.18 changelog; I don’t see it in the corresponding backport releases in earlier branches.

[darakian]

Gotcha. Looks like The 0.x versions are also published over here
https://github.com/kubernetes/apiserver
and the commit notes point out that they are based on the corresponding 1.x releases of the main project.

Many thanks for the PR. This should close #2745 as well.

[advisory-database]

Hi @skitt! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!