CVE-2020-8554 — Vulnetix

Try Vulnetix Request Demo

CVE-2020-8554 REJECTED

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.

EPSS 25.26% · 96.1th percentile

Risk Scores

EPSS Score

25.26%

96.1th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:Pro:20.04:LTS	kubernetes	0, 1.0
Ubuntu:22.04:LTS	kubernetes	0, 1.0
Ubuntu:24.04:LTS	kubernetes	0, 1.0

Timeline

CVE Published
Apr 14, 2021 EPSS Score
Jul 21, 2021 EPSS Score
Nov 4, 2021 PoC Published
Feb 8, 2022 EPSS Score
Apr 20, 2022 EPSS Score
Mar 17, 2025 EPSS Score
Mar 19, 2025 EPSS Score
Mar 20, 2025 EPSS Score
Mar 22, 2025 EPSS Score
Mar 27, 2025 EPSS Score
Mar 28, 2025 EPSS Score

References

https://ubuntu.com/security/CVE-2020-8554 third-party-advisory
https://www.openwall.com/lists/oss-security/2020/12/07/5 third-party-advisory
https://github.com/kubernetes/kubernetes/issues/97076 third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2020-8554 third-party-advisory

Open in Interactive Console →