CVE-2021-25737: kubernetes Incomplete List of Disallowed Inputs
CVSS: 4.9v2.0MediumModified
AliasesUBUNTU-CVE-2021-25737DEBIAN-CVE-2021-25737GHSA-mfv7-gq43-w965GO-2022-0908
Published 06-09-2021Last modified 16-09-2024
Vulnerability summary
CVE-2021-25737 is a medium (CVSS 4.9) Incomplete List of Disallowed Inputs vulnerability in kubernetes. EPSS estimates a 1.33% chance of exploitation in the next 30 days, higher than 70.5% of scored vulnerabilities.
CVSS score
4.9/10
010
Medium · v2.0 (NVD)EPSS score
1.33%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 06-09-2021PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.
CVSS metrics
6 scores · 5 sources · 2 versionsLow 2.7Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NSources5 sources · 2.7–4.8
- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · GoEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NDiffers
- NVDNIST4.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NDiffers
Medium 4.9Preferred score · NVD (NIST)
AV:N/AC:M/Au:S/C:P/I:P/A:NSourcesSingle source
EPSS trend
Probability
1.33%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
0.00 pp
From 1.33% on 19-09-2026
19-09-202619-10-2026
EPSS score1.33%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-184Incomplete List of Disallowed InputsThe product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
- CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Affected systems
Debian1 product
- kubernetes< 1.20.5+really1.20.2-1
K8s.io1 product
- kubernetes≥ 1.16.0, < 1.18.19 | ≥ 1.19.0, < 1.19.11 | ≥ 1.20.0, < 1.20.7 | ≥ 1.21.0, < 1.21.1
Kubernetes1 product
- kubernetesEOL≥ unspecified, ≤ 1.18.18 | ≥ unspecified, ≤ 1.19.10 | ≥ unspecified, ≤ 1.20.6 | ≥ unspecified, ≤ 1.21.0 | ≥ 1.16.0, < 1.18.19 | ≥ 1.19.0, < 1.19.10 | ≥ 1.20.0, < 1.20.7 | 1.21.0
Ubuntu1 product
- kubernetesAll versions (No fix recorded)
4 vendors · 4 products
References
11 links- groups.google.com/g/kubernetes-security-announce/c/xAiN3924thYX Refsource MISCWEBMailing ListThird Party Advisory
