~ / search / GHSA-j9wf-vvm6-4r9w

GHSA-j9wf-vvm6-4r9w

Unverified Ownership in Kubernetes

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-8554

Packages

EcosystemPackageAffectedFixed in
Go k8s.io/kubernetes <= 1.22.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.

References

External links from the advisory. They lead to third-party sites.