CVE-2021-25735
Validating Admission Webhook does not observe some previous fields
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.
Se ha detectado un problema de seguridad en kube-apiserver que podría permitir a las actualizaciones de los nodos omitir un Validating Admission Webhook. Los clusters sólo están afectados por esta vulnerabilidad si ejecutan un Validating Admission Webhook para nodos que deniega la admisión basándose, al menos parcialmente, en el estado antiguo del objeto Node. El Validating Admission Webhook no comprueba algunos campos anteriores.
A vulnerability was found in Kubernetes' kube-apiserver that could allow Node updates to bypass a Validating Admission Webhook. An authenticated user could exploit this by modifying Node properties to values that should have been prevented by registered admission webhooks.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-01-21 CVE Reserved
- 2021-04-23 First Exploit
- 2021-07-28 CVE Published
- 2023-03-30 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
- CWE-372: Incomplete Internal State Distinction
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y | Mailing List |
| URL | Date | SRC |
|---|---|---|
| https://github.com/darryk10/CVE-2021-25735 | 2021-04-23 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/kubernetes/kubernetes/issues/100096 | 2023-06-26 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2021-25735 | 2021-07-27 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1937562 | 2021-07-27 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | < 1.18.18 Search vendor "Kubernetes" for product "Kubernetes" and version " < 1.18.18" | - |
Affected
| ||||||
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.19.0 < 1.19.10 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.19.0 < 1.19.10" | - |
Affected
| ||||||
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.20.0 < 1.20.6 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.20.0 < 1.20.6" | - |
Affected
| ||||||