Vulnerability-Lookup

ubuntu-cve-2021-25735

Vulnerability from osv_ubuntu

Published

2021-09-06 12:15

Modified

2025-07-14 04:47

Summary

Details

A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.

Severity

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2021-25735	REPORT
	https://www.openwall.com/lists/oss-security/2021/…	REPORT
	https://github.com/kubernetes/kubernetes/issues/100096	REPORT
	https://www.cve.org/CVERecord?id=CVE-2021-25735	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "kubernetes",
        "purl": "pkg:deb/ubuntu/kubernetes@1.0?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0"
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "kubernetes",
        "purl": "pkg:deb/ubuntu/kubernetes@1.0?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0"
      ]
    },
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "kubernetes",
        "purl": "pkg:deb/ubuntu/kubernetes@1.0?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0"
      ]
    }
  ],
  "aliases": [],
  "details": "A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.",
  "id": "UBUNTU-CVE-2021-25735",
  "modified": "2025-07-14T04:47:14Z",
  "published": "2021-09-06T12:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-25735"
    },
    {
      "type": "REPORT",
      "url": "https://www.openwall.com/lists/oss-security/2021/04/14/1"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/kubernetes/kubernetes/issues/100096"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-25735"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2021-25735"
  ],
  "withdrawn": "2025-08-28T17:00:31Z"
}

CVE-2021-25735 (GCVE-0-2021-25735)

Vulnerability from cvelistv5 – Published: 2021-09-06 11:32 – Updated: 2024-09-16 23:40

Title

Validating Admission Webhook does not observe some previous fields

Summary

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

CWE

CWE-372 - Incomplete Internal State Distinction

Assigner

kubernetes

References

2 references

URL	Tags
https://groups.google.com/g/kubernetes-security-a…	x_refsource_MISC
https://github.com/kubernetes/kubernetes/issues/100096	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Kubernetes	Kubernetes	Affected: unspecified , ≤ 1.18.17 (custom) Affected: unspecified , ≤ 1.19.9 (custom) Affected: unspecified , ≤ 1.20.5 (custom)

Date Public

2021-04-14 00:00

Credits

Rogerio Bastos & Ari Lima

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:11:27.512Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/kubernetes/kubernetes/issues/100096"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kubernetes",
          "vendor": "Kubernetes",
          "versions": [
            {
              "lessThanOrEqual": "1.18.17",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.19.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.20.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Rogerio Bastos \u0026 Ari Lima"
        }
      ],
      "datePublic": "2021-04-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-372",
              "description": "CWE-372 Incomplete Internal State Distinction",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-06T11:32:00.000Z",
        "orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
        "shortName": "kubernetes"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubernetes/kubernetes/issues/100096"
        }
      ],
      "source": {
        "defect": [
          "https://github.com/kubernetes/kubernetes/issues/100096"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Validating Admission Webhook does not observe some previous fields",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@kubernetes.io",
          "DATE_PUBLIC": "2021-04-14T16:00:00.000Z",
          "ID": "CVE-2021-25735",
          "STATE": "PUBLIC",
          "TITLE": "Validating Admission Webhook does not observe some previous fields"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Kubernetes",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "1.18.17"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "1.19.9"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "1.20.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Kubernetes"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Rogerio Bastos \u0026 Ari Lima"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-372 Incomplete Internal State Distinction"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y",
              "refsource": "MISC",
              "url": "https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y"
            },
            {
              "name": "https://github.com/kubernetes/kubernetes/issues/100096",
              "refsource": "MISC",
              "url": "https://github.com/kubernetes/kubernetes/issues/100096"
            }
          ]
        },
        "source": {
          "defect": [
            "https://github.com/kubernetes/kubernetes/issues/100096"
          ],
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
    "assignerShortName": "kubernetes",
    "cveId": "CVE-2021-25735",
    "datePublished": "2021-09-06T11:32:00.853Z",
    "dateReserved": "2021-01-21T00:00:00.000Z",
    "dateUpdated": "2024-09-16T23:40:25.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2021-25735

Vulnerability from osv_ubuntu

CVE-2021-25735 (GCVE-0-2021-25735)

Tags

Sightings

Nomenclature