GHSA-mfv7-gq43-w965MediumCVSS 4.8

Incomplete List of Disallowed Inputs in Kubernetes

Published
September 7, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-25737 →

📋 Description

A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.

🎯 Affected products4

  • go/k8s.io/kubernetes:>= 1.16.0, < 1.18.19
  • go/k8s.io/kubernetes:>= 1.19.0, < 1.19.11
  • go/k8s.io/kubernetes:>= 1.20.0, < 1.20.7
  • go/k8s.io/kubernetes:= 1.21.0

🔗 References (5)