Riskcovery

CVE-2020-8558

Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

State
Published
Severity
5.4 Medium
Published
Jul 27, 2020
Updated
Sep 16, 2024
Reserved
Feb 3, 2020

Read the record on cve.org

Description

The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.

Scores

CVSSScoreVectorSource
3.15.4 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nkubernetes

Weaknesses

  • CWE-420 Unprotected Alternate Channel

Affected Products

ProductVersions
KubernetesKubernetes
  • prior to 1.18.4Affected
  • prior to 1.17.7Affected
  • prior to 1.16.11Affected
  • 1.15Affected
  • 1.14Affected
  • 1.13Affected
  • 1.12Affected
  • 1.11Affected
  • 1.10Affected
  • 1.9Affected
  • 1.8Affected
  • 1.7Affected
  • 1.6Affected
  • 1.5Affected
  • 1.4Affected
  • 1.3Affected
  • 1.2Affected
  • 1.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.