CVE-2021-25736

Summary

Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a LoadBalancer Service when the LoadBalancer controller does not set the “status.loadBalancer.ingress[].ip” field. Clusters where the LoadBalancer controller sets the “status.loadBalancer.ingress[].ip” field are unaffected.

Affected Software

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/kubernetes/kubernetes/pull/99958
• https://groups.google.com/g/kubernetes-security-announce/c/lIoOPObO51Q/m/O15LOazPAgAJ
• https://security.netapp.com/advisory/ntap-20231221-0003/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/kubernetes/kubernetes/pull/99958
• https://groups.google.com/g/kubernetes-security-announce/c/lIoOPObO51Q/m/O15LOazPAgAJ
• https://security.netapp.com/advisory/ntap-20231221-0003/

• ←Previous
• Next→