{"containers": {"cna": {"affected": [{"product": "Kubernetes", "vendor": "Kubernetes", "versions": [{"lessThanOrEqual": "1.18.17", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThanOrEqual": "1.19.9", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThanOrEqual": "1.20.5", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Rogerio Bastos & Ari Lima"}], "datePublic": "2021-04-14T00:00:00", "descriptions": [{"lang": "en", "value": "A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-372", "description": "CWE-372 Incomplete Internal State Distinction", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-09-06T11:32:00", "orgId": "a6081bf6-c852-4425-ad4f-a67919267565", "shortName": "kubernetes"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/kubernetes/kubernetes/issues/100096"}], "source": {"defect": ["https://github.com/kubernetes/kubernetes/issues/100096"], "discovery": "EXTERNAL"}, "title": "Validating Admission Webhook does not observe some previous fields", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@kubernetes.io", "DATE_PUBLIC": "2021-04-14T16:00:00.000Z", "ID": "CVE-2021-25735", "STATE": "PUBLIC", "TITLE": "Validating Admission Webhook does not observe some previous fields"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Kubernetes", "version": {"version_data": [{"version_affected": "<=", "version_value": "1.18.17"}, {"version_affected": "<=", "version_value": "1.19.9"}, {"version_affected": "<=", "version_value": "1.20.5"}]}}]}, "vendor_name": "Kubernetes"}]}}, "credit": [{"lang": "eng", "value": "Rogerio Bastos & Ari Lima"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-372 Incomplete Internal State Distinction"}]}]}, "references": {"reference_data": [{"name": "https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y", "refsource": "MISC", "url": "https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y"}, {"name": "https://github.com/kubernetes/kubernetes/issues/100096", "refsource": "MISC", "url": "https://github.com/kubernetes/kubernetes/issues/100096"}]}, "source": {"defect": ["https://github.com/kubernetes/kubernetes/issues/100096"], "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T20:11:27.512Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/kubernetes/kubernetes/issues/100096"}]}]}, "cveMetadata": {"assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565", "assignerShortName": "kubernetes", "cveId": "CVE-2021-25735", "datePublished": "2021-09-06T11:32:00.853331Z", "dateReserved": "2021-01-21T00:00:00", "dateUpdated": "2024-09-16T23:40:25.902Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*", "matchCriteriaId": "2CBC03B5-FF1D-45D7-A8F9-288DF2057568", "versionEndExcluding": "1.18.18", "vulnerable": true}, {"criteria": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*", "matchCriteriaId": "54F99BEF-703E-43C0-846C-AB9EECE134A9", "versionEndExcluding": "1.19.10", "versionStartIncluding": "1.19.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*", "matchCriteriaId": "E26E82C1-754C-4E81-B7BC-FB4DACE33945", "versionEndExcluding": "1.20.6", "versionStartIncluding": "1.20.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields."}, {"lang": "es", "value": "Se ha detectado un problema de seguridad en kube-apiserver que podr\u00eda permitir a las actualizaciones de los nodos omitir un Validating Admission Webhook. Los clusters s\u00f3lo est\u00e1n afectados por esta vulnerabilidad si ejecutan un Validating Admission Webhook para nodos que deniega la admisi\u00f3n bas\u00e1ndose, al menos parcialmente, en el estado antiguo del objeto Node. El Validating Admission Webhook no comprueba algunos campos anteriores."}], "id": "CVE-2021-25735", "lastModified": "2024-11-21T05:55:19.043", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 5.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "jordan@liggitt.net", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-09-06T12:15:07.617", "references": [{"source": "jordan@liggitt.net", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/kubernetes/kubernetes/issues/100096"}, {"source": "jordan@liggitt.net", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/kubernetes/kubernetes/issues/100096"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y"}], "sourceIdentifier": "jordan@liggitt.net", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-372"}], "source": "jordan@liggitt.net", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank the Kubernetes Product Security Committee for reporting this issue. Upstream acknowledges Ari Lima (Red Hat) and Rogerio Bastos (Red Hat) as the original reporters.", "affected_release": [{"advisory": "RHSA-2021:2437", "cpe": "cpe:/a:redhat:openshift:4.8::el7", "package": "openshift-0:4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8", "product_name": "Red Hat OpenShift Container Platform 4.8", "release_date": "2021-07-27T00:00:00Z"}], "bugzilla": {"description": "kubernetes: Validating Admission Webhook does not observe some previous fields", "id": "1937562", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1937562"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "status": "verified"}, "cwe": "CWE-20", "details": ["A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.", "A vulnerability was found in Kubernetes' kube-apiserver that could allow Node updates to bypass a Validating Admission Webhook. An authenticated user could exploit this by modifying Node properties to values that should have been prevented by registered admission webhooks."], "name": "CVE-2021-25735", "package_state": [{"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Will not fix", "package_name": "atomic-openshift", "product_name": "Red Hat OpenShift Container Platform 3.11"}], "public_date": "2021-04-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-25735\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-25735\nhttps://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y"], "threat_severity": "Moderate", "upstream_fix": "kubernetes 1.21.0, kubernetes 1.20.6, kubernetes 1.19.10, kubernetes 1.18.18"}