CVE-2021-25737

A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.

Published: Sep 6, 2021
Updated: May 9, 2024
CVE: CVE-2021-25737
GHSA: GHSA-mfv7-gq43-w965
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.8
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

Severity: Low
Score: 4.9
AV:N/AC:M/Au:S/C:P/I:P/A:N

CWEs:

CWE-184
CWE-601

Affected Software
References

Software	From	Fixed in
kubernetes / kubernetes	1.19.0	1.19.10
kubernetes / kubernetes	1.16.0	1.18.19
kubernetes / kubernetes	1.20.0	1.20.7
kubernetes / kubernetes	1.21.0	1.21.0.x
k8s.io/kubernetes	1.16.0	1.18.19
k8s.io/kubernetes	1.19.0	1.19.11
k8s.io/kubernetes	1.20.0	1.20.7
k8s.io/kubernetes	1.21.0	1.21.0.x
k8s.io/kubernetes	1.21.0	1.21.1

https://github.com/kubernetes/kubernetes/issues/102106
https://groups.google.com/g/kubernetes-security-announce/c/xAiN3924thY
https://security.netapp.com/advisory/ntap-20211004-0004/

Vulnerability Database

CVE-2021-25737

Deep Security Visibility Without the Complexity