Information disclosure in Kubernetes - CVE-2021-25737

Vulnerability identifier: #VU53436

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-25737

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to a host network hijacking flaw because of holes in EndpointSlice validation. A remote administrator can redirect pod traffic to private networks on a Node and gain unauthorized access to sensitive information on the system.

Kubernetes
Arch Linux
openEuler
IBM Cloud Private
Red Hat OpenShift Container Platform
Migration Toolkit for Containers
toolbox (Red Hat package)
coreos-installer (Red Hat package)
python-openshift (Red Hat package)
butane (Red Hat package)
python-pyrsistent (Red Hat package)
console-login-helper-messages (Red Hat package)
python-eventlet (Red Hat package)
python-hardware (Red Hat package)
python-openstacksdk (Red Hat package)
runc (Red Hat package)
python-oslo-upgradecheck (Red Hat package)
rteval-loads (Red Hat package)
kubernetes-kubeadm
kubernetes-help
kubernetes-master
kubernetes-node
kubernetes-client
kubernetes-kubelet
kubernetes
cri-tools (Red Hat package)
cri-o (Red Hat package)
python-sushy-oem-idrac (Red Hat package)
kata-containers (Red Hat package)
python-debtcollector (Red Hat package)
python-ironic-prometheus-exporter (Red Hat package)
haproxy (Red Hat package)
python-oslo-service (Red Hat package)
python-tooz (Red Hat package)
ignition (Red Hat package)
openvswitch2.15 (Red Hat package)
jenkins (Red Hat package)
podman (Red Hat package)
python-oslo-context (Red Hat package)
python-jsonschema (Red Hat package)
python-stevedore (Red Hat package)
python-oslo-policy (Red Hat package)
python-sushy (Red Hat package)
python-oslo-serialization (Red Hat package)
python-keystoneauth1 (Red Hat package)
python-oslo-concurrency (Red Hat package)
python-oslo-log (Red Hat package)
python-ironic-lib (Red Hat package)
python-oslo-utils (Red Hat package)
openshift-kuryr (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift-ansible (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
jenkins-2-plugins (Red Hat package)
rust-afterburn (Red Hat package)
python-oslo-i18n (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
python-oslo-db (Red Hat package)
python-oslo-config (Red Hat package)
openstack-ironic-inspector (Red Hat package)
python-kubernetes (Red Hat package)
openstack-ironic (Red Hat package)
ovn2.13 (Red Hat package)
redhat-release-coreos (Red Hat package)
ostree (Red Hat package)
ironic-images (Red Hat package)

Install updates from vendor's website.

Kubernetes - addressed in versions 1.18.19, 1.19.11, 1.20.7, 1.21.1
IBM Cloud Private - addressed in versions 3.2.1.2203, 3.2.2.2203
Red Hat OpenShift Container Platform - addressed in versions 4.8.2, 4.10.30
toolbox (Red Hat package) - update to 0.0.8-3.rhaos4.8.el8
coreos-installer (Red Hat package) - update to 0.9.0-6.rhaos4.8.el8
python-openshift (Red Hat package) - update to 0.12.1-1.el8
butane (Red Hat package) - update to 0.12.1-1.rhaos4.8.el8
python-pyrsistent (Red Hat package) - update to 0.16.0-3.el8ost
console-login-helper-messages (Red Hat package) - update to 0.20.3-1.rhaos4.8.el8
python-eventlet (Red Hat package) - update to 0.25.2-4.el8
python-hardware (Red Hat package) - update to 0.27.0-0.20210406121246.756fedb.el8
python-openstacksdk (Red Hat package) - update to 0.53.0-0.20210325011601.4629245.el8
runc (Red Hat package) - addressed in versions 1.0.0-98.rhaos4.8.gitcd80260.el7, 1.0.0-98.rhaos4.8.gitcd80260.el8
python-oslo-upgradecheck (Red Hat package) - update to 1.3.0-0.20210325003851.9f95a6e.el8
rteval-loads (Red Hat package) - update to 1.4-12.el8
Migration Toolkit for Containers - update to 1.5.1
kubernetes-kubeadm - update to 1.20.2-5
kubernetes-help - update to 1.20.2-5
kubernetes-master - update to 1.20.2-5
kubernetes-node - update to 1.20.2-5
kubernetes-client - update to 1.20.2-5
kubernetes-kubelet - update to 1.20.2-5
kubernetes - update to 1.20.2-5
cri-tools (Red Hat package) - addressed in versions 1.21.0-2.el7, 1.21.0-2.el8
cri-o (Red Hat package) - addressed in versions 1.21.2-5.rhaos4.8.gitb27d974.el7, 1.21.2-5.rhaos4.8.gitb27d974.el8
python-sushy-oem-idrac (Red Hat package) - update to 2.0.1-0.20210326152858.83b7eb0.el8
kata-containers (Red Hat package) - update to 2.1.0-4.el8
python-debtcollector (Red Hat package) - update to 2.2.0-0.20210324220630.649189d.el8
python-ironic-prometheus-exporter (Red Hat package) - update to 2.2.1-0.20210325143713.70e39c8.el8
haproxy (Red Hat package) - addressed in versions 2.2.13-1.el7, 2.2.13-1.el8
python-oslo-service (Red Hat package) - update to 2.5.0-0.20210325014731.d25e454.el8
python-tooz (Red Hat package) - update to 2.8.0-0.20210324235001.54448e9.el8
ignition (Red Hat package) - update to 2.9.0-6.rhaos4.8.el8
openvswitch2.15 (Red Hat package) - update to 2.15.0-9.el8fdp
jenkins (Red Hat package) - update to 2.289.1.1624020353-1.el8
podman (Red Hat package) - update to 3.0.1-6.el8
python-oslo-context (Red Hat package) - update to 3.2.0-0.20210325043103.0d02866.el8
python-jsonschema (Red Hat package) - update to 3.2.0-5.el8ost
python-stevedore (Red Hat package) - update to 3.3.0-0.20210325001012.7d7154f.el8
python-oslo-policy (Red Hat package) - update to 3.7.0-0.20210325051823.d853485.el8
python-sushy (Red Hat package) - update to 3.7.1-0.20210428165244.bc49878.el8
python-oslo-serialization (Red Hat package) - update to 4.1.0-0.20210325012242.8445e61.el8
python-keystoneauth1 (Red Hat package) - update to 4.3.0-0.20210325001456.6a66271.el8
python-oslo-concurrency (Red Hat package) - update to 4.4.0-0.20210325004915.7dcf9e9.el8
python-oslo-log (Red Hat package) - update to 4.4.0-0.20210409081224.9b29c90.el8
python-ironic-lib (Red Hat package) - update to 4.6.2-0.20210608101214.ca2e4ba.el8
python-oslo-utils (Red Hat package) - update to 4.8.0-0.20210325043201.3288539.el8
openshift-kuryr (Red Hat package) - update to 4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8
atomic-openshift-service-idler (Red Hat package) - update to 4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8
openshift-ansible (Red Hat package) - update to 4.8.0-202106281541.p0.git.626f7a3.assembly.stream.el7
openshift-clients (Red Hat package) - addressed in versions 4.8.0-202106281541.p0.git.1077b05.assembly.stream.el7, 4.8.0-202106281541.p0.git.1077b05.assembly.stream.el8
openshift (Red Hat package) - addressed in versions 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7, 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - update to 4.8.1624022417-1.el8
rust-afterburn (Red Hat package) - update to 5.0.0-1.rhaos4.8.el8
python-oslo-i18n (Red Hat package) - update to 5.0.1-0.20210324221600.73187bd.el8
openstack-ironic-python-agent (Red Hat package) - update to 7.0.2-0.20210611153100.bfa97cb.el8
python-oslo-db (Red Hat package) - update to 8.5.0-0.20210325041241.503db60.el8
python-oslo-config (Red Hat package) - update to 8.5.0-0.20210325050501.cfa2564.el8
openstack-ironic-inspector (Red Hat package) - update to 10.6.1-0.20210406091336.579f59c.el8
python-kubernetes (Red Hat package) - update to 12.0.1-1.el8
openstack-ironic (Red Hat package) - update to 17.0.4-0.20210713221218.a415e7e.el8
ovn2.13 (Red Hat package) - update to 20.12.0-25.el8fdp
redhat-release-coreos (Red Hat package) - update to 48.84-4.el8
ostree (Red Hat package) - update to 2020.7-5.el8_4
ironic-images (Red Hat package) - update to 2021.1-20210614.1.el8

• https://github.com/kubernetes/kubernetes/issues/102106
• https://seclists.org/oss-sec/2021/q2/155

• Information disclosure in Kubernetes
• Arch Linux update for kube-apiserver
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers
• IBM Cloud Private update for Kubernetes
• Multiple vulnerabilities in OpenShift Container Platform 4.10
• openEuler update for kubernetes
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.8 packages