CVE-2022-31074

KubeEdge Cloud AdmissionController component DoS

Description

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, several endpoints in the Cloud AdmissionController may be susceptible to a DoS attack if an HTTP request containing a very large Body is sent to it. The consequence of the exhaustion is that the Cloud AdmissionController will be in denial of service. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. There is currently no known workaround.

References

Link	Tags
https://github.com/kubeedge/kubeedge/security/advisories/GHSA-w52j-3457-q9wr	third party advisory

Frequently Asked Questions

What is the severity of CVE-2022-31074?: CVE-2022-31074 has been scored as a medium severity vulnerability.
How to fix CVE-2022-31074?: To fix CVE-2022-31074, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-31074 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2022-31074 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-31074?: CVE-2022-31074 affects kubeedge kubeedge.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.

Description

Category

CWE-400 – Uncontrolled Resource Consumption

References

Frequently Asked Questions