VDB
CVE-2021-25735
CVE-2021-25735
REJECTED
CVSS 6.5 MEDIUM
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.
EPSS 5.38% · 92.6th percentile
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
EPSS Score
5.38%
92.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:24.04:LTS | kubernetes | 0, 1.0 |
| Ubuntu:Pro:20.04:LTS | kubernetes | 1.0, 0 |
| Ubuntu:22.04:LTS | kubernetes | 0, 1.0 |
Timeline
- May 28, 2021 CVE Published
- Sep 6, 2021 EPSS Score
- Dec 31, 2021 EPSS Score
- Feb 27, 2022 EPSS Score
- Apr 26, 2022 EPSS Score
- Aug 21, 2022 EPSS Score
- Dec 15, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 10, 2023 EPSS Score
- Aug 4, 2023 EPSS Score
- Nov 28, 2023 EPSS Score
- Mar 24, 2024 EPSS Score
References
- https://www.openwall.com/lists/oss-security/2021/04/14/1 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2021-25735 third-party-advisory
- https://ubuntu.com/security/CVE-2021-25735 advisory
- https://github.com/kubernetes/kubernetes/issues/100096 discussion