Validating Admission Webhook does not observe some previous fields (Kubernetes Kubernetes)
En bref
- Source
- NVD
- EPSS
- EPSS 5.38 % · centile 93 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- kubernetes
- Statut NVD
- Modified
Description
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.
Faiblesses (CWE)
- CWE-372 — Incomplete Internal State Distinction
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H | kubernetes |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H | NVD · jordan@liggitt.net (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.5 | AV:N/AC:L/Au:S/C:N/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-g42g-737j-qx6j — Access Restriction Bypass in kube-apiserver
- GO-2022-0907 — Access Restriction Bypass in kube-apiserver in k8s.io/kubernetes
Références européennes
- ENISA EUVD · EUVD-2021-1071
- GCVE · GCVE-0-2021-25735
Avis du CERT-FR
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2022-AVI-591 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*< 1.18.18cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*≥ 1.19.0 < 1.19.10cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*≥ 1.20.0 < 1.20.6
Produits affectés
| Produit | Versions |
|---|---|
| Kubernetes · Kubernetes | affected unspecified ≤ 1.18.17 ; affected unspecified ≤ 1.19.9 ; affected unspecified ≤ 1.20.5 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |