En bref
- CVE-2021-25736 est une vulnérabilité MOYENNE (CVSS 6.3) touchant k8s.io/kubernetes, kubernetes (kubernetes).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.92%, plus élevée que 60.2% des vulnérabilités.
- Correctif : mettre à jour vers 1.21.0, 1.18.18, 1.19.10, 1.20.6 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| k8s.io/kubernetes Go | < 1.21.0
| 1.21.0
|
| kubernetes | ≥ 1.18.0, < 1.18.18≥ 1.19.0, < 1.19.10≥ 1.20.0, < 1.20.6
| 1.18.181.19.101.20.6
|
Description
Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (spec.ports[*].port) as a LoadBalancer Service when the LoadBalancer controller does not set the status.loadBalancer.ingress[].ip field. Clusters
where the LoadBalancer controller sets the status.loadBalancer.ingress[].ip field are unaffected.
NVD description
Kube-proxy
on Windows can unintentionally forward traffic to local processes
listening on the same port (“spec.ports[*].port”) as a LoadBalancer
Service when the LoadBalancer controller
does not set the “status.loadBalancer.ingress[].ip” field. Clusters
where the LoadBalancer controller sets the
“status.loadBalancer.ingress[].ip” field are unaffected.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free