CVSS: 4.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-8561 – Webhook redirect in kube-apiserver
https://notcve.org/view.php?id=CVE-2020-8561
A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs. Se ha detectado un problema de seguridad en Kubernetes donde los actores que controlan las respuestas de las peticiones MutatingWebhookConfiguration o ValidatingWebhookConfiguration son capaces de redirigir las peticiones de kube-apiserver a redes privadas del apiserver. Si ese usuario puede visualizar los registros de kube-apiserver cuando el nivel de registro se establece en 10, puede visualizar las respuestas redirigidas y los encabezados en los registros • https://github.com/kubernetes/kubernetes/issues/104720 https://groups.google.com/g/kubernetes-security-announce/c/RV2IhwcrQsY https://security.netapp.com/advisory/ntap-20211014-0002 • CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') CWE-610: Externally Controlled Reference to a Resource in Another Sphere •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2021-25735 – Validating Admission Webhook does not observe some previous fields
https://notcve.org/view.php?id=CVE-2021-25735
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields. Se ha detectado un problema de seguridad en kube-apiserver que podría permitir a las actualizaciones de los nodos omitir un Validating Admission Webhook. Los clusters sólo están afectados por esta vulnerabilidad si ejecutan un Validating Admission Webhook para nodos que deniega la admisión basándose, al menos parcialmente, en el estado antiguo del objeto Node. • https://github.com/darryk10/CVE-2021-25735 https://github.com/kubernetes/kubernetes/issues/100096 https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y https://access.redhat.com/security/cve/CVE-2021-25735 https://bugzilla.redhat.com/show_bug.cgi?id=1937562 • CWE-20: Improper Input Validation CWE-372: Incomplete Internal State Distinction •
CVSS: 4.9EPSS: 0%CPEs: 4EXPL: 0CVE-2021-25737 – Holes in EndpointSlice Validation Enable Host Network Hijack
https://notcve.org/view.php?id=CVE-2021-25737
A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs. Se ha detectado un problema de seguridad en Kubernetes en el que un usuario puede ser capaz de redirigir el tráfico del pod a redes privadas en un Nodo. Kubernetes ya previene la creación de IPs de Endpoint en el rango localhost o link-local, pero no se ha llevado a cabo la misma comprobación en las IPs de EndpointSlice. A security issue was discovered in Kubernetes where an authorized user may be able to redirect traffic to private networks on a Node. • https://github.com/kubernetes/kubernetes/issues/102106 https://groups.google.com/g/kubernetes-security-announce/c/xAiN3924thY https://security.netapp.com/advisory/ntap-20211004-0004 https://access.redhat.com/security/cve/CVE-2021-25737 https://bugzilla.redhat.com/show_bug.cgi?id=1954917 • CWE-20: Improper Input Validation CWE-184: Incomplete List of Disallowed Inputs CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-25736 – Windows kube-proxy LoadBalancer contention
https://notcve.org/view.php?id=CVE-2021-25736
Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a LoadBalancer Service when the LoadBalancer controller does not set the “status.loadBalancer.ingress[].ip” field. Clusters where the LoadBalancer controller sets the “status.loadBalancer.ingress[].ip” field are unaffected. Kube-proxy en Windows puede reenviar tráfico involuntariamente a procesos locales que escuchan en el mismo puerto (“spec.ports[*].port”) que LoadBalancer Service cuando el controlador LoadBalancer no configura “status.loadBalancer.ingress[].ip”. Los clústeres donde el controlador LoadBalancer establece el campo "status.loadBalancer.ingress[].ip" no se ven afectados. A flaw was found in the Windows kube-proxy component. • https://github.com/kubernetes/kubernetes/pull/99958 https://groups.google.com/g/kubernetes-security-announce/c/lIoOPObO51Q/m/O15LOazPAgAJ https://security.netapp.com/advisory/ntap-20231221-0003 https://access.redhat.com/security/cve/CVE-2021-25736 https://bugzilla.redhat.com/show_bug.cgi?id=1946538 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21661
https://notcve.org/view.php?id=CVE-2021-21661
Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Jenkins Kubernetes CLI Plugin versión 1.10.0 y anteriores no lleva a cabo comprobaciones de permisos en varios endpoints HTTP, permitiendo a atacantes con permiso Overall/Read enumerar los ID de las credenciales almacenadas en Jenkins • http://www.openwall.com/lists/oss-security/2021/06/10/14 https://www.jenkins.io/security/advisory/2021-06-10/#SECURITY-2370 •