This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-25737 →

DEBIAN-CVE-2021-25737

A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already preve...

Original description

The description as published by the source.

A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 kubernetes

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]

Debian:13 kubernetes

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]

Debian:14 kubernetes

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]

References

advisory security-tracker.debian.org