CVE-2021-25737
CVE-2021-25737 · Holes in EndpointSlice Validation Enable Host Network Hijack
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.
CVSS 2.7 · Low · EPSS 1.3% · Fix available
- Published
- Updated
Stack: system · containers
Affected products and versions
kubernetes
- Versions
- ≥ unspecified, ≤ 1.18.18: Affected (custom)
- ≥ unspecified, ≤ 1.19.10: Affected (custom)
- ≥ unspecified, ≤ 1.20.6: Affected (custom)
- ≥ unspecified, ≤ 1.21.0: Affected (custom)
No fix published
kubernetes Debian:12
- Affected ranges
- ECOSYSTEM: < 1.20.5+really1.20.2-1
Update to 1.20.5+really1.20.2-1
kubernetes Debian:13
- Affected ranges
- ECOSYSTEM: < 1.20.5+really1.20.2-1
Update to 1.20.5+really1.20.2-1
kubernetes Debian:14
- Affected ranges
- ECOSYSTEM: < 1.20.5+really1.20.2-1
Update to 1.20.5+really1.20.2-1