GHSA-35c7-w35f-xwgh CVE-2021-25736 GO-2023-2159
Kube-proxy may unintentionally forward traffic
- Severity
- 5.8 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.92%
- Chance of exploitation in the next 30 days. Higher than 60.17% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-114 Process Control
- Fix
1.21.0- Upgrade k8s.io/kubernetes to this version or later
Description
Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (spec.ports[*].port) as a LoadBalancer Service when the LoadBalancer controller does not set the status.loadBalancer.ingress[].ip field. Clusters
where the LoadBalancer controller sets the status.loadBalancer.ingress[].ip field are unaffected.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| k8s.io/kubernetes | < 1.21.0 |
1.21.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
k8s.io/kubernetes Go → 1.21.0
- go
go get k8s.io/kubernetes@v1.21.0 && go mod tidy
Severity breakdown
CVSS 3.1 5.8
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- High
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-114: Process Control
Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.
How to prevent it
- Architecture and Design: Libraries that are loaded should be well understood and come from a trusted source. The application can execute code contained in the native libraries, which often contain calls that are susceptible to other security problems, such as buffer overflows or command injection. All native libraries should be validated to determine if the application requires the use of the library. It is very difficult to determine what these native libraries actually do, and the potential for malicious code is high. In addition, the potential for an inadvertent mistake in these native libraries is also high, as many are written in C or C++ and may be susceptible to buffer overflow or race condition problems. To help prevent buffer overflow attacks, validate all input to native calls for content and length. If the native library does not come from a trusted source, review the source code of the library. The library should be built from the reviewed source before using it.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-r6j8-c6r2-37rr kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass | Medium | Also affects k8s.io/kubernetes |
| GHSA-4x4m-3c2p-qppc Kubernetes Nodes can delete themselves by adding an OwnerReference | Medium | Also affects k8s.io/kubernetes |
| GHSA-hj2p-8wj8-pfq4 kubernetes allows nodes to bypass dynamic resource allocation authorization checks | Low | Also affects k8s.io/kubernetes |
| GO-2025-3547 Kubernetes kube-apiserver Vulnerable to Race Condition | Low | Also affects k8s.io/kubernetes |
| GHSA-3wgm-2gw2-vh5m Kubernetes GitRepo Volume Inadvertent Local Repository Access | Medium | Also affects k8s.io/kubernetes |
| GHSA-vv39-3w5q-974q Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API | Medium | Also affects k8s.io/kubernetes |
| GHSA-jgfp-53c3-624w Node Denial of Service via kubelet Checkpoint API | Medium | Also affects k8s.io/kubernetes |
| GHSA-27wf-5967-98gx Kubernetes kubelet arbitrary command execution | High | Also affects k8s.io/kubernetes |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor