CVE-2020-8561

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

Published: Sep 20, 2021
Updated: May 9, 2024
CVE: CVE-2020-8561
GHSA: GHSA-74j8-88mm-7496
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.1
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

CVSS v2:

Severity: Low
Score: 4
AV:N/AC:L/Au:S/C:P/I:N/A:N

CWEs:

CWE-441
CWE-610

Affected Software
References

Software	From	Fixed in
kubernetes / kubernetes	1.20.11	1.20.11.x
kubernetes / kubernetes	1.21.5	1.21.5.x
kubernetes / kubernetes	1.22.2	1.22.2.x
k8s.io/kubernetes	-	1.22.2.x

https://github.com/kubernetes/kubernetes/issues/104720
https://groups.google.com/g/kubernetes-security-announce/c/RV2IhwcrQsY
https://security.netapp.com/advisory/ntap-20211014-0002/

Vulnerability Database

CVE-2020-8561

Deep Security Visibility Without the Complexity