p PatchFirst

CVE-2020-8554

CVE-2020-8554 · Kubernetes man in the middle using LoadBalancer or ExternalIPs

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.

CVSS 6.3 · Medium · EPSS 9.3% · Public exploit · Fix available

Published
Updated

Stack: system · containers

Affected products and versions

  • kubernetes

    Versions
    • ≥ 0: Affected (semver)

    No fix published

  • kubernetes Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.31.4+ds-1

    Update to 1.31.4+ds-1

  • kubernetes Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.31.4+ds-1

    Update to 1.31.4+ds-1

Original sources

Check your server →