In short
- CVE-2021-25736 is a MEDIUM (CVSS 6.3) vulnerability affecting k8s.io/kubernetes, kubernetes (kubernetes).
- Chance of exploitation in the next 30 days (EPSS): 0.92%, higher than 60.2% of all vulnerabilities.
- Fix: update to 1.21.0, 1.18.18, 1.19.10, 1.20.6 or later.
| Package | Affected versions | Patched versions |
|---|
| k8s.io/kubernetes Go | < 1.21.0
| 1.21.0
|
| kubernetes | ≥ 1.18.0, < 1.18.18≥ 1.19.0, < 1.19.10≥ 1.20.0, < 1.20.6
| 1.18.181.19.101.20.6
|
Description
Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (spec.ports[*].port) as a LoadBalancer Service when the LoadBalancer controller does not set the status.loadBalancer.ingress[].ip field. Clusters
where the LoadBalancer controller sets the status.loadBalancer.ingress[].ip field are unaffected.
NVD description
Kube-proxy
on Windows can unintentionally forward traffic to local processes
listening on the same port (“spec.ports[*].port”) as a LoadBalancer
Service when the LoadBalancer controller
does not set the “status.loadBalancer.ingress[].ip” field. Clusters
where the LoadBalancer controller sets the
“status.loadBalancer.ingress[].ip” field are unaffected.
More vulnerabilities in k8s.io/kubernetes
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free