Holes in EndpointSlice Validation Enable Host Network Hijack
CVE-2021-25740

3.1LOW

Key Information:

Vendor

Kubernetes
Status
Kubernetes
Vendor
CVE Published:
20 September 2021

What is CVE-2021-25740?

A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Kubernetes <= 1.20.11

Kubernetes <= 1.21.5

Kubernetes <= 1.22.2

References

https://groups.google.com/g/kubernetes-security-announce/...
x_refsource_MISC
https://github.com/kubernetes/kubernetes/issues/103675
x_refsource_MISC
https://security.netapp.com/advisory/ntap-20211014-0001/
x_refsource_CONFIRM

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rob Scott
JSON
.