Log in Start free

Vulnerability · Published Jul 27, 2020 · Assigned by kubernetes

CVE-2020-8558Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

Medium 5.4

In plain English

A medium-severity security flaw in Kubernetes from Kubernetes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)3.4%top 11.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12kubernetes1.18.5-1DEBIAN-CVE-2020-8558
Debian:13kubernetes1.18.5-1DEBIAN-CVE-2020-8558
Debian:14kubernetes1.18.5-1DEBIAN-CVE-2020-8558
Gok8s.io/kubernetes1.16.11, 1.17.7, 1.18.4GO-2022-0885
Gok8s.io/kubernetes1.18.4GHSA-wqv3-8cm6-h6wg
Gok8s.io/kubernetes1.17.7GHSA-wqv3-8cm6-h6wg
Gok8s.io/kubernetes1.16.11GHSA-wqv3-8cm6-h6wg
Ubuntu:22.04:LTSkubernetesno fix listedUBUNTU-CVE-2020-8558
Ubuntu:24.04:LTSkubernetesno fix listedUBUNTU-CVE-2020-8558

Affected products (as reported)

VendorProductVersions
Kubernetes Kubernetes prior to 1.18.4prior to 1.17.7prior to 1.16.111.151.141.131.121.11

Weakness: CWE-420 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References