Access Restriction Bypass in kube-apiserver

🗓️ 28 May 2021 19:49:59Reported by GitHub Advisory DatabaseType

Access Restriction Bypass in kube-apiserver due to validation manipulatio

Reporter	Title	Published	Views	Family All 45
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	8 Jun 202321:56	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Kubernetes kube-apiserver may affect IBM Robotic Process Automation for Cloud Pak and result in a bypass of security restrictions (CVE-2021-25735).	20 Jun 202314:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® Db2® On Openshift and IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data	29 Jun 202217:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	18 Aug 202504:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes API server security vulnerability (CVE-2021-25735)	7 May 202110:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM CICS TX Advanced is vulnerable to multiple vulnerabilities in Kubernetes.	14 Feb 202321:04	–	ibm
IBM Security Bulletins	Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a Kubernetes API server security vulnerability (CVE-2021-25735)	4 Feb 202217:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM CICS TX Standard is vulnerable to multiple vulnerabilities in Kubernetes.	14 Feb 202321:14	–	ibm
GithubExploit	Exploit for Incomplete Internal State Distinction in Kubernetes	22 Apr 202107:25	–	githubexploit
AlpineLinux	CVE-2021-25735	6 Sep 202111:32	–	alpinelinux

Vulners

Node

k8s.io kubernetesRange≤1.18.17go

k8s.io kubernetesRange1.19.0–1.19.9go

k8s.io kubernetesRange1.20.0–1.20.5go

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-25735
github	www.github.com/kubernetes/kubernetes/issues/100096
github	www.github.com/kubernetes/kubernetes/pull/99946
github	www.github.com/kubernetes/kubernetes/commit/00e81db174ef7aca497be5f42d87e46d14df2a90
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
groups	www.groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y
pkg	www.pkg.go.dev/k8s.io/[email protected]/cmd/kube-apiserver
sysdig	www.sysdig.com/blog/cve-2021-25735-kubernetes-admission-bypass/
github	www.github.com/advisories/GHSA-g42g-737j-qx6j

31 Jul 2023 20:31Current

2.5Low risk

Vulners AI Score2.5

CVSS 25.5

CVSS 3.16.5

EPSS0.16302