Windows kube-proxy LoadBalancer contention
CVE-2021-25736

6.3MEDIUM

Key Information:

Vendor

Kubernetes
Status
Kubernetes
Vendor
CVE Published:
30 October 2023

What is CVE-2021-25736?

Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a LoadBalancer Service when the LoadBalancer controller does not set the “status.loadBalancer.ingress[].ip” field. Clusters where the LoadBalancer controller sets the “status.loadBalancer.ingress[].ip” field are unaffected.

Affected Version(s)

Kubernetes Windows 0

References

https://github.com/kubernetes/kubernetes/pull/99958
https://groups.google.com/g/kubernetes-security-announce/...
https://security.netapp.com/advisory/ntap-20231221-0003/

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eric Paris
Christian Hernandez
.