In breve
- CVE-2021-25736 è una vulnerabilità MEDIO (CVSS 6.3) che riguarda k8s.io/kubernetes, kubernetes (kubernetes).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.92%, superiore al 60.2% delle vulnerabilità.
- Correzione: aggiornare a 1.21.0, 1.18.18, 1.19.10, 1.20.6 o successiva.
| Package | Affected versions | Patched versions |
|---|
| k8s.io/kubernetes Go | < 1.21.0
| 1.21.0
|
| kubernetes | ≥ 1.18.0, < 1.18.18≥ 1.19.0, < 1.19.10≥ 1.20.0, < 1.20.6
| 1.18.181.19.101.20.6
|
Description
Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (spec.ports[*].port) as a LoadBalancer Service when the LoadBalancer controller does not set the status.loadBalancer.ingress[].ip field. Clusters
where the LoadBalancer controller sets the status.loadBalancer.ingress[].ip field are unaffected.
NVD description
Kube-proxy
on Windows can unintentionally forward traffic to local processes
listening on the same port (“spec.ports[*].port”) as a LoadBalancer
Service when the LoadBalancer controller
does not set the “status.loadBalancer.ingress[].ip” field. Clusters
where the LoadBalancer controller sets the
“status.loadBalancer.ingress[].ip” field are unaffected.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free