[kubernetes] CVE-2021-25735: Validating Admission Webhook does not observe some previous fields

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
[kubernetes] CVE-2021-25735: Validating Admission Webhook does not observe some previous fields

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Tim Allclair &lt;timallclair () gmail com&gt;

Date: Wed, 14 Apr 2021 09:06:02 -0700

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
A security issue was discovered in kube-apiserver that could allow node
updates to bypass a Validating Admission Webhook. You are only affected by
this vulnerability if you run a Validating Admission Webhook for Nodes that
denies admission based at least partially on the old state of the Node
object.

This issue has been rated Medium (
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
&lt;https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H&gt;),
and assigned CVE-2021-25735.

Note: This only impacts validating admission plugins that rely on old
values in certain fields, and does not impact calls from kubelets that go
through the built-in NodeRestriction admission plugin.
Affected Versions

   -

   kube-apiserver v1.20.0 - v1.20.5
   -

   kube-apiserver v1.19.0 - v1.19.9
   -

   kube-apiserver &lt;= v1.18.17

Fixed Versions

This issue is fixed in the following versions:

   -

   kube-apiserver v1.21.0
   -

   kube-apiserver v1.20.6
   -

   kube-apiserver v1.19.10
   -

   kube-apiserver v1.18.18

Detection

If you find evidence that this vulnerability has been exploited, please
contact security () kubernetes io
Additional Details

See Kubernetes Issue #100096
&lt;https://github.com/kubernetes/kubernetes/issues/100096&gt; for more details.
Acknowledgements

This vulnerability was reported by Rogerio Bastos &amp; Ari Lima from RedHat

Thank You,

Tim Allclair on behalf of the Kubernetes Product Security Committee

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

[kubernetes] CVE-2021-25735: Validating Admission Webhook does not observe some previous fields Tim Allclair (Apr 14)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->