CVE-2020-8558: kubernetes Unprotected Alternate Channel
Vulnerability summary
CVE-2020-8558 is a high (CVSS 8.8) Unprotected Alternate Channel vulnerability in kubernetes. EPSS estimates a 3.60% chance of exploitation in the next 30 days, higher than 89.3% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 4 · Related 4Timeline
- 27-07-2020PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.
CVSS metrics
9 scores · 8 sources · 2 versions- CVE.orgCNA5.4MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NDiffers
- OSV · Red hatEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · GoEcosystem advisory · calculated8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.60%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.60% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundKubernetes
Maturity: poc
Exploit Reference (groups.google.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat2 products
- openshift< 0:4.3.31-202007280738.p0.git.0.9884401.el7 | < 0:4.3.31-202007280738.p0.git.0.9884401.el8
- openshift-hyperkube< 0:4.3.31-202007280738.p0.git.0.9884401.el7 | < 0:4.3.31-202007280738.p0.git.0.9884401.el8
Chainguard1 product
- kubeflow-pipelinesAll versions (No fix recorded)
Debian1 product
- kubernetes< 1.18.5-1
K8s.io1 product
- kubernetes≥ 1.17.0, < 1.17.7 | < 1.16.11 | ≥ 1.18.0, < 1.18.4
Kubernetes1 product
- kubernetesprior to 1.18.4 | prior to 1.17.7 | prior to 1.16.11 | 1.15 | 1.14 | 1.13 | 1.12 | 1.11 | 1.10 | 1.9 | 1.8 | 1.7 | 1.6 | 1.5 | 1.4 | 1.3 | 1.2 | 1.1 | ≥ 1.1.0, ≤ 1.16.10 | ≥ 1.17.0, ≤ 1.17.6 | ≥ 1.18.0, ≤ 1.18.3
Ubuntu1 product
- kubernetesAll versions (No fix recorded)
Wolfi1 product
- kubeflow-pipelinesAll versions (No fix recorded)
7 vendors · 8 products
References
20 links- github.com/kubernetes/kubernetes/issues/92315X Refsource CONFIRMFIXWEBExploitMitigationPatchThird Party Advisory
- groups.google.com/g/kubernetes-announce/c/sI4KmlH3S2I/m/TljjxOBvBQAJMailing ListX Refsource MLISTEVIDENCEWEBExploitMitigationThird Party Advisory
