#VU54339 Protection Mechanism Failure in Kubernetes - CVE-2021-25736

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU54339

#VU54339 Protection Mechanism Failure in Kubernetes - CVE-2021-25736

Published: June 23, 2021


Vulnerability identifier: #VU54339
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U/U:Green
CVE-ID: CVE-2021-25736
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Kubernetes
Software vendor:
Kubernetes

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures in the Windows kube-proxy component. In a cloud environment that does not set the “.status.loadBalancer.ingress.ip” field in the LoadBalancer service status configuration (for example in AWS) the packets can be misrouted and reach an unintended destination. An attacker can bypass implemented security restrictions and perform MitM attack.


Remediation

Install updates from vendor's website.

External links