High severityNVD Advisory· Published Sep 18, 2023· Updated Sep 25, 2024
CVE-2023-32187
CVE-2023-32187
Description
An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.0 before v1.25.13+k3s1, from v1.26.0 before v1.26.8+k3s1, from sev1.27.0 before v1.27.5+k3s1, from v1.28.0 before v1.28.1+k3s1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/k3s-io/k3sGo | < 1.24.17 | 1.24.17 |
github.com/k3s-io/k3sGo | >= 1.25.0, < 1.25.13 | 1.25.13 |
github.com/k3s-io/k3sGo | >= 1.26.0, < 1.26.8 | 1.26.8 |
github.com/k3s-io/k3sGo | >= 1.27.0, < 1.27.5 | 1.27.5 |
github.com/k3s-io/k3sGo | >= 1.28.0, < 1.28.1 | 1.28.1 |
Affected products
12- osv-coords11 versionspkg:apk/chainguard/k3spkg:apk/chainguard/k3s-embeddedpkg:apk/chainguard/k3s-imagespkg:apk/chainguard/k3s-multicallpkg:apk/chainguard/k3s-staticpkg:apk/wolfi/k3spkg:apk/wolfi/k3s-embeddedpkg:apk/wolfi/k3s-imagespkg:apk/wolfi/k3s-multicallpkg:apk/wolfi/k3s-staticpkg:golang/github.com/k3s-io/k3s
< 1.27.5-r0+ 10 more
- (no CPE)range: < 1.27.5-r0
- (no CPE)range: < 1.27.5-r0
- (no CPE)range: < 1.27.5-r0
- (no CPE)range: < 1.27.5-r0
- (no CPE)range: < 1.27.5-r0
- (no CPE)range: < 1.27.5-r0
- (no CPE)range: < 1.27.5-r0
- (no CPE)range: < 1.27.5-r0
- (no CPE)range: < 1.27.5-r0
- (no CPE)range: < 1.27.5-r0
- (no CPE)range: < 1.24.17
- SUSE/k3sv5Range: v1.24.0
Patches
Vulnerability mechanics
References
5News mentions
0No linked articles in our index yet.