VDB
CVE-2021-25735
CVE-2021-25735
REJECTED
CVSS 6.5 MEDIUM
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.
EPSS 5.52% · 92.3th percentile
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
EPSS Score
5.52%
92.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:24.04:LTS | kubernetes | 0, 1.0 |
| Ubuntu:Pro:20.04:LTS | kubernetes | 1.0, 0 |
| Ubuntu:22.04:LTS | kubernetes | 0, 1.0 |
Timeline
- May 28, 2021 CVE Published
- Sep 6, 2021 EPSS Score
- Dec 31, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 26, 2022 EPSS Score
- Aug 20, 2022 EPSS Score
- Dec 14, 2022 EPSS Score
- Feb 10, 2023 EPSS Score
- Apr 9, 2023 EPSS Score
- Aug 3, 2023 EPSS Score
- Nov 27, 2023 EPSS Score
- Jan 23, 2024 EPSS Score
References
- https://ubuntu.com/security/CVE-2021-25735 third-party-advisory
- https://www.openwall.com/lists/oss-security/2021/04/14/1 third-party-advisory
- https://github.com/kubernetes/kubernetes/issues/100096 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2021-25735 third-party-advisory