Validating Admission Webhook does not observe some previous fields (Kubernetes Kubernetes)
At a glance
- Source
- NVD
- EPSS
- EPSS 5.38 % · percentile 93 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- kubernetes
- NVD status
- Modified
Description
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.
Weaknesses (CWE)
- CWE-372 — Incomplete Internal State Distinction
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H | kubernetes |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H | NVD · jordan@liggitt.net (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.5 | AV:N/AC:L/Au:S/C:N/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-g42g-737j-qx6j — Access Restriction Bypass in kube-apiserver
- GO-2022-0907 — Access Restriction Bypass in kube-apiserver in k8s.io/kubernetes
European references
- ENISA EUVD · EUVD-2021-1071
- GCVE · GCVE-0-2021-25735
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2022-AVI-591 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*< 1.18.18cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*≥ 1.19.0 < 1.19.10cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*≥ 1.20.0 < 1.20.6
Affected products
| Product | Versions |
|---|---|
| Kubernetes · Kubernetes | affected unspecified ≤ 1.18.17 ; affected unspecified ≤ 1.19.9 ; affected unspecified ≤ 1.20.5 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |