CVE-2021-25736: Kube-proxy may unintentionally forward traffic
(updated )
Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (spec.ports[*].port) as a LoadBalancer Service when the LoadBalancer controller does not set the status.loadBalancer.ingress[].ip field. Clusters
where the LoadBalancer controller sets the status.loadBalancer.ingress[].ip field are unaffected.
References
- github.com/advisories/GHSA-35c7-w35f-xwgh
- github.com/kubernetes/kubernetes/commit/b014610de3e5cf1bb0f7844b5758d29fc18b75e6
- github.com/kubernetes/kubernetes/pull/99958
- groups.google.com/g/kubernetes-security-announce/c/lIoOPObO51Q/m/O15LOazPAgAJ
- nvd.nist.gov/vuln/detail/CVE-2021-25736
- security.netapp.com/advisory/ntap-20231221-0003
Code Behaviors & Features
Detect and mitigate CVE-2021-25736 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →