Database/Container, Kubernetes & orchestration
Kubernetes: Endpoint/EndpointSlice confused-deputy lets users reach networks they should not
CVSS 3.1CVE-2021-25740Container, Kubernetes & orchestrationcurated
Impact
Endpoint/EndpointSlice confused-deputy lets users reach networks they should not
Who can reach it
Cluster user with namespace access
What to do
No complete upstream fix; restrict Endpoint creation via admission policy
References
Related entries
- Kubernetes: Endpoint IPs can redirect pod traffic to private node networksCVE-2021-25737 · KubernetesLow
- Kubernetes: Command injection via pod spec on Windows nodesCVE-2023-3676 · KubernetesHigh
- Kubernetes: Second Windows-node input-sanitisation escalation to adminCVE-2023-3955 · KubernetesHigh
- Kubernetes: Malformed docker config leaks registry pull secrets into logsCVE-2020-8564 · KubernetesMedium
- Kubernetes: Authorization and bearer tokens written to logs at verbosity 9CVE-2020-8565 · KubernetesMedium
- cosign / sigstore: Attacker-controlled registry returns unbounded attestations, DoSing the verifierCVE-2023-46737 · cosign / sigstoreLow
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.