Security controls bypass or absence In k8s.io/kubernetes
Description
Unverified Ownership in Kubernetes Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 go | 1.22.1-rc.0 | ||
go | - | - | |
go | - | - | |
go | - | - | |
go | - | - | |
go | - | - | |
 debian 14 | 1.31.4+ds-1 | ||
debian 13 | 1.31.4+ds-1 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16.