A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.
Advisories
Source ID Title
EUVD EUVD EUVD-2024-3260 A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.
Github GHSA Github GHSA GHSA-h7wq-jj8r-qm7p Kubernetes Nil pointer dereference in KCM after v1 HPA patch request
Fixes

Solution

No solution given by the vendor.


Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

History

Sun, 17 Nov 2024 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Sun, 17 Nov 2024 11:00:00 +0000

Type Values Removed Values Added
Title kube-controller-manager: malformed HPA v1 manifest causes crash Kube-controller-manager: malformed hpa v1 manifest causes crash
CPEs cpe:/a:redhat:openshift:4
cpe:/a:redhat:openshift:4.12::el9
cpe:/a:redhat:openshift:4.13::el9
References

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-11-17T16:16:49.847Z

Reserved: 2024-01-22T21:32:10.068Z

Link: CVE-2024-0793

cve-icon Vulnrichment

Updated: 2024-11-17T16:16:46.979Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-11-17T11:15:06.340

Modified: 2024-11-18T17:11:17.393

Link: CVE-2024-0793

cve-icon Redhat

Severity : Important

Publid Date: 2024-02-07T00:00:00Z

Links: CVE-2024-0793 - Bugzilla

cve-icon OpenCVE Enrichment

No data.