kubernetes: CVE-2020-8554 CVE-2020-8562 CVE-2021-25735 CVE-2021-25737

Debian Bug report logs - #990793
kubernetes: CVE-2020-8554 CVE-2020-8562 CVE-2021-25735 CVE-2021-25737

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: submit@bugs.debian.org

Subject: kubernetes: CVE-2020-8554 CVE-2020-8562 CVE-2021-25735 CVE-2021-25737

Date: Wed, 7 Jul 2021 17:45:39 +0200

Source: kubernetes
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerabilities were published for kubernetes.

These are not relevant for bullseye, as it only includes the client
package, but relevant for updates via fasttrack after the release:

CVE-2020-8554[0]:
| Kubernetes API server in all versions allow an attacker who is able to
| create a ClusterIP service and set the spec.externalIPs field, to
| intercept traffic to that IP address. Additionally, an attacker who is
| able to patch the status (which is considered a privileged operation
| and should not typically be granted to users) of a LoadBalancer
| service can set the status.loadBalancer.ingress.ip to similar effect.

https://www.openwall.com/lists/oss-security/2020/12/07/5
https://github.com/kubernetes/kubernetes/issues/97076

CVE-2020-8562[1]:
https://www.openwall.com/lists/oss-security/2021/05/04/8

CVE-2021-25735[2]:
Validating Admission Webhook does not observe some previous fields
https://www.openwall.com/lists/oss-security/2021/04/14/1
https://github.com/kubernetes/kubernetes/issues/100096

CVE-2021-25737[3]:
https://www.openwall.com/lists/oss-security/2021/05/18/4

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-8554
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8554
[1] https://security-tracker.debian.org/tracker/CVE-2020-8562
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8562
[2] https://security-tracker.debian.org/tracker/CVE-2021-25735
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25735
[3] https://security-tracker.debian.org/tracker/CVE-2021-25737
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25737

Please adjust the affected versions in the BTS as needed.

Message #10 received at 990793@bugs.debian.org (full text, mbox, reply):

From: Shengjing Zhu <zhsj@debian.org>

To: Moritz Mühlenhoff <jmm@inutil.org>, 990793@bugs.debian.org

Subject: Re: Bug#990793: kubernetes: CVE-2020-8554 CVE-2020-8562 CVE-2021-25735 CVE-2021-25737

Date: Thu, 8 Jul 2021 00:27:08 +0800

On Wed, Jul 7, 2021 at 11:48 PM Moritz Mühlenhoff <jmm@inutil.org> wrote:
>
> Source: kubernetes
> X-Debbugs-CC: team@security.debian.org
> Severity: important
> Tags: security
>
> Hi,
>
> The following vulnerabilities were published for kubernetes.
>
> These are not relevant for bullseye, as it only includes the client
> package, but relevant for updates via fasttrack after the release:

Bullseye still includes the server package.

$ rmadison -S kubernetes
kubernetes        | 1.20.2-1              | testing    | source
kubernetes        | 1.20.5+really1.20.2-1 | unstable   | source
kubernetes-client | 1.20.2-1              | testing    | amd64, arm64,
armel, armhf, i386, s390x
kubernetes-client | 1.20.5+really1.20.2-1 | unstable   | amd64, arm64,
armel, armhf, i386, s390x
kubernetes-master | 1.20.2-1              | testing    | amd64, arm64,
armel, armhf, i386, s390x
kubernetes-node   | 1.20.2-1              | testing    | amd64, arm64,
armel, armhf, i386, s390x

-- 
Shengjing Zhu

Message #15 received at 990793@bugs.debian.org (full text, mbox, reply):

From: Janos LENART <lenartj@gmail.com>

To: Shengjing Zhu <zhsj@debian.org>, 990793@bugs.debian.org

Cc: Moritz Mühlenhoff <jmm@inutil.org>

Subject: Re: Bug#990793: kubernetes: CVE-2020-8554 CVE-2020-8562 CVE-2021-25735 CVE-2021-25737

Date: Wed, 7 Jul 2021 17:33:21 +0100

[Message part 1 (text/plain, inline)]

Thanks for the report Moritz.

As zhsj@ wrote bullseye atm has 1.20.2-1, which has the server packages,
instead of 1.20.5+really1.20.2-1, which does only includes that client it
was of course uploaded for exactly this reason. I will file a bug so the
correct version gets included in bullseye.

On Wed, 7 Jul 2021 at 17:30, Shengjing Zhu <zhsj@debian.org> wrote:

> On Wed, Jul 7, 2021 at 11:48 PM Moritz Mühlenhoff <jmm@inutil.org> wrote:
> >
> > Source: kubernetes
> > X-Debbugs-CC: team@security.debian.org
> > Severity: important
> > Tags: security
> >
> > Hi,
> >
> > The following vulnerabilities were published for kubernetes.
> >
> > These are not relevant for bullseye, as it only includes the client
> > package, but relevant for updates via fasttrack after the release:
>
> Bullseye still includes the server package.
>
> $ rmadison -S kubernetes
> kubernetes        | 1.20.2-1              | testing    | source
> kubernetes        | 1.20.5+really1.20.2-1 | unstable   | source
> kubernetes-client | 1.20.2-1              | testing    | amd64, arm64,
> armel, armhf, i386, s390x
> kubernetes-client | 1.20.5+really1.20.2-1 | unstable   | amd64, arm64,
> armel, armhf, i386, s390x
> kubernetes-master | 1.20.2-1              | testing    | amd64, arm64,
> armel, armhf, i386, s390x
> kubernetes-node   | 1.20.2-1              | testing    | amd64, arm64,
> armel, armhf, i386, s390x
>
> --
> Shengjing Zhu
>


-- 
LÉNÁRT, János
<lenartj@gmail.com>

[Message part 2 (text/html, inline)]

Message #22 received at 990793@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Shengjing Zhu <zhsj@debian.org>, ocsi@debian.org

Cc: 990793@bugs.debian.org

Subject: Re: Bug#990793: kubernetes: CVE-2020-8554 CVE-2020-8562 CVE-2021-25735 CVE-2021-25737

Date: Wed, 7 Jul 2021 19:58:49 +0200

On Thu, Jul 08, 2021 at 12:27:08AM +0800, Shengjing Zhu wrote:
> On Wed, Jul 7, 2021 at 11:48 PM Moritz Mühlenhoff <jmm@inutil.org> wrote:
> >
> > Source: kubernetes
> > X-Debbugs-CC: team@security.debian.org
> > Severity: important
> > Tags: security
> >
> > Hi,
> >
> > The following vulnerabilities were published for kubernetes.
> >
> > These are not relevant for bullseye, as it only includes the client
> > package, but relevant for updates via fasttrack after the release:
> 
> Bullseye still includes the server package.

Oh indeed. Janos, can you please file an unblock request?

Cheers,
        Moritz

Send a report that this bug log contains spam.