GitHub Advisoryadvisory · Go

GHSA-35c7-w35f-xwgh Kube-proxy may unintentionally forward traffic

MEDIUM Published 2023-10-30 Modified 2026-07-06 Official page ↗
Aliases
CVE-2021-25736
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Reviewed
2023-10-31

Affected packages

• Go k8s.io/kubernetes: < 1.21.0 → fixed in 1.21.0

Description

Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (`spec.ports[*].port`) as a LoadBalancer Service when the LoadBalancer controller does not set the `status.loadBalancer.ingress[].ip` field. Clusters where the LoadBalancer controller sets the `status.loadBalancer.ingress[].ip` field are unaffected.

Related

Alias · CVE (1)

  • CVE-2021-25736 Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a… vulnerability

References