4.8 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
4.9 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:P/I:P/A:N
0.001 Low
EPSS
Percentile
24.7%
Severity: Low
Date : 2021-06-09
CVE-ID : CVE-2021-25737
Package : kube-apiserver
Type : insufficient validation
Remote : Yes
Link : https://security.archlinux.org/AVG-1970
The package kube-apiserver before version 1.21.1-1 is vulnerable to
insufficient validation.
Upgrade to 1.21.1-1.
The problem has been fixed upstream in version 1.21.1.
To mitigate this vulnerability without upgrading kube-apiserver, you
can create a validating admission webhook that prevents EndpointSlices
with endpoint addresses in the 127.0.0.0/8 and 169.254.0.0/16 ranges.
If you have an existing admission policy mechanism (like OPA
Gatekeeper) you can create a policy that enforces this restriction.
A security issue was discovered in kube-apiserver before version 1.21.1
where a user may be able to redirect pod traffic to private networks on
a node. Kubernetes already prevents creation of Endpoint IPs in the
localhost or link-local range, but the same validation was not
performed on EndpointSlice IPs.
A user could redirect pod traffic to private networks on a node.
https://github.com/kubernetes/kubernetes/issues/102106
https://github.com/kubernetes/kubernetes/pull/101084
https://github.com/kubernetes/kubernetes/commit/233c8d6eeef9e7a259c39dd1db096479044820ae
https://security.archlinux.org/CVE-2021-25737
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | kube-apiserver | <ย 1.21.1-1 | UNKNOWN |
4.8 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
4.9 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:P/I:P/A:N
0.001 Low
EPSS
Percentile
24.7%