==================================================================== CERT-Renater Note d'Information No. 2021/VULN221 _____________________________________________________________________ DATE : 15/04/2021 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running kube-apiserver versions prior to 1.21.0, 1.20.6, 1.19.10, 1.18.18. ===================================================================== https://groups.google.com/g/kubernetes-announce/c/C18YGzrugGg _____________________________________________________________________ A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. You are only affected by this vulnerability if you run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. This issue has been rated Medium ( CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H ), and assigned CVE-2021-25735. Note: This only impacts validating admission plugins that rely on old values in certain fields, and does not impact calls from kubelets that go through the built-in NodeRestriction admission plugin. Affected Versions - kube-apiserver v1.20.0 - v1.20.5 - kube-apiserver v1.19.0 - v1.19.9 - kube-apiserver <= v1.18.17 Fixed Versions This issue is fixed in the following versions: - kube-apiserver v1.21.0 - kube-apiserver v1.20.6 - kube-apiserver v1.19.10 - kube-apiserver v1.18.18 Detection If you find evidence that this vulnerability has been exploited, please contact security () kubernetes io Additional Details See Kubernetes Issue #100096 for more details. Acknowledgements This vulnerability was reported by Rogerio Bastos & Ari Lima from RedHat Thank You, Tim Allclair on behalf of the Kubernetes Product Security Committee ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================