CVE-2021-25736 (Medium) detected in github.com/kubernetes/kubernetes-v1.16.6

[mend-for-github-com]

CVE-2021-25736 - Medium Severity Vulnerability

Vulnerable Library - github.com/kubernetes/kubernetes-v1.16.6

Production-Grade Container Scheduling and Management

Dependency Hierarchy:

• ❌ github.com/kubernetes/kubernetes-v1.16.6 (Vulnerable Library)

Found in HEAD commit: 23cd89752b5978470bb8f7c88cae5ab268573cea

Found in base branch: master

Vulnerability Details

A flaw was found in the Windows kube-proxy component in Kubernetes before 1.18.18, 1.19.10, 1.20.6, 1.21.0. In a cloud environment that does not set the “.status.loadBalancer.ingress.ip” field in the LoadBalancer service status configuration (for example in AWS) the packets can be misrouted and reach an unintended destination.

Publish Date: 2021-01-22

URL: CVE-2021-25736

CVSS 3 Score Details (5.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: High
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1946538

Release Date: 2021-01-22

Fix Resolution: kubernetes - 1.18.18, 1.19.10, 1.20.6, 1.21.0

---

• Check this box to open an automated fix PR