Vulnerability · Published Sep 6, 2021 · Assigned by kubernetes
CVE-2021-25735Validating Admission Webhook does not observe some previous fields
Medium 6.5
In plain English
A medium-severity security flaw in Kubernetes from Kubernetes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.4% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | k3s | 1.20.6.1-r0 | ALPINE-CVE-2021-25735 |
| Alpine:v3.21 | k3s | 1.20.6.1-r0 | ALPINE-CVE-2021-25735 |
| Alpine:v3.22 | k3s | 1.20.6.1-r0 | ALPINE-CVE-2021-25735 |
| Alpine:v3.23 | k3s | 1.20.6.1-r0 | ALPINE-CVE-2021-25735 |
| Alpine:v3.24 | k3s | 1.20.6.1-r0 | ALPINE-CVE-2021-25735 |
| Debian:12 | kubernetes | 1.20.5+really1.20.2-1 | DEBIAN-CVE-2021-25735 |
| Debian:13 | kubernetes | 1.20.5+really1.20.2-1 | DEBIAN-CVE-2021-25735 |
| Debian:14 | kubernetes | 1.20.5+really1.20.2-1 | DEBIAN-CVE-2021-25735 |
| Go | k8s.io/kubernetes | 1.18.18 | GHSA-g42g-737j-qx6j |
| Go | k8s.io/kubernetes | 1.20.6 | GHSA-g42g-737j-qx6j |
| Go | k8s.io/kubernetes | 1.19.10 | GHSA-g42g-737j-qx6j |
| Go | k8s.io/kubernetes | 1.18.18, 1.19.10, 1.20.6 | GO-2022-0907 |
| Ubuntu:22.04:LTS | kubernetes | no fix listed | UBUNTU-CVE-2021-25735 |
| Ubuntu:24.04:LTS | kubernetes | no fix listed | UBUNTU-CVE-2021-25735 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kubernetes | Kubernetes | unspecified – through 1.18.17unspecified – through 1.19.9unspecified – through 1.20.5 |
Weakness: CWE-372 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
References
- https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y x_refsource_MISC
- https://github.com/kubernetes/kubernetes/issues/100096 x_refsource_MISC