SB2021093040 - openEuler update for kubernetes

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2021-25737)

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to a host network hijacking flaw because of holes in EndpointSlice validation. A remote administrator can redirect pod traffic to private networks on a Node and gain unauthorized access to sensitive information on the system.

2) Input validation error (CVE-ID: CVE-2021-25735)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in kube-apiserver that could allow Node updates to bypass a Validating Admission Webhook. An authenticated user could exploit this by modifying Node properties to values that should have been prevented by registered admission webhooks.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1373