CVSS: 3.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-8562 – Bypass of Kubernetes API Server proxy TOCTOU
https://notcve.org/view.php?id=CVE-2020-8562
As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. Como mitigación a un informe de 2019 y CVE-2020-8555, Kubernetes intenta impedir que las conexiones proxy accedan a las redes link-local o localhost cuando son realizadas conexiones impulsadas por el usuario a los servicios, pods, nodos o proveedores de servicios StorageClass. • https://github.com/kubernetes/kubernetes/issues/101493 https://groups.google.com/g/kubernetes-security-announce/c/-MFX60_wdOY https://security.netapp.com/advisory/ntap-20220225-0002 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 3.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-25743 – ANSI escape characters in kubectl output are not being filtered
https://notcve.org/view.php?id=CVE-2021-25743
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events. kubectl no neutraliza las secuencias de escape, meta o de control contenidas en los datos brutos que envía a un terminal. Esto incluye, pero no se limita, a los campos de cadena no estructurados en objetos como los Eventos • https://github.com/kubernetes/kubernetes/issues/101695 https://security.netapp.com/advisory/ntap-20220217-0003 • CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 2CVE-2021-25741 – Symlink Exchange Can Allow Host Filesystem Access
https://notcve.org/view.php?id=CVE-2021-25741
A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem. Se ha detectado un problema de seguridad en Kubernetes en el que un usuario puede ser capaz de crear un contenedor con montajes de volumen de sub-ruta para acceder a archivos y directorios fuera del volumen, incluso en el sistema de archivos del host A flaw was found in kubernetes. An authorized user can exploit this by creating pods with crafted subpath volume mounts to access files and directories outside of the volume, including on the host node's filesystem. • https://github.com/Betep0k/CVE-2021-25741 https://github.com/cdxiaodong/CVE-2021-25741 https://github.com/kubernetes/kubernetes/issues/104980 https://groups.google.com/g/kubernetes-security-announce/c/nyfdhK24H7s https://security.netapp.com/advisory/ntap-20211008-0006 https://access.redhat.com/security/cve/CVE-2021-25741 https://bugzilla.redhat.com/show_bug.cgi?id=1993749 • CWE-20: Improper Input Validation CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-552: Files or Directories Accessible to External Parties •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2021-25735 – Validating Admission Webhook does not observe some previous fields
https://notcve.org/view.php?id=CVE-2021-25735
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields. Se ha detectado un problema de seguridad en kube-apiserver que podría permitir a las actualizaciones de los nodos omitir un Validating Admission Webhook. Los clusters sólo están afectados por esta vulnerabilidad si ejecutan un Validating Admission Webhook para nodos que deniega la admisión basándose, al menos parcialmente, en el estado antiguo del objeto Node. • https://github.com/darryk10/CVE-2021-25735 https://github.com/kubernetes/kubernetes/issues/100096 https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y https://access.redhat.com/security/cve/CVE-2021-25735 https://bugzilla.redhat.com/show_bug.cgi?id=1937562 • CWE-20: Improper Input Validation CWE-372: Incomplete Internal State Distinction •
CVSS: 6.3EPSS: 0%CPEs: 4EXPL: 3CVE-2020-8554 – Kubernetes man in the middle using LoadBalancer or ExternalIPs
https://notcve.org/view.php?id=CVE-2020-8554
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect. El servidor de la API de Kubernetes en todas las versiones permite a un atacante que puede crear un servicio ClusterIP y establecer el campo spec.externalIPs, interceptar el tráfico a esa dirección IP. Adicionalmente, un atacante que sea capaz de parchear el estado (que se considera una operación privilegiada y no se debe típicamente otorgar a los usuarios) de un servicio LoadBalancer puede configurar el status.loadBalancer.ingress.ip con un efecto similar A flaw was found in kubernetes. If a potential attacker can already create or edit services and pods, then they may be able to intercept traffic from other pods (or nodes) in the cluster. • https://github.com/jrmurray000/CVE-2020-8554 https://github.com/Dviejopomata/CVE-2020-8554 https://github.com/kubernetes/kubernetes/issues/97076 https://groups.google.com/g/kubernetes-security-announce/c/iZWsF9nbKE8 https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40%40%3Ccommits.druid.apache.org%3E https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942%40%3Ccommits.druid.apache.org%3E https://lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef82 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-283: Unverified Ownership •