3.5

CVE-2020-8562

Bypass of Kubernetes API Server proxy TOCTOU

As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Kubernetes ≫ Kubernetes Version <= 1.18.18
Kubernetes ≫ Kubernetes Version >= 1.19.0 <= 1.19.10
Kubernetes ≫ Kubernetes Version >= 1.20.0 <= 1.20.6
Kubernetes ≫ Kubernetes Version1.21.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.08% 0.608
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 3.1 1.6 1.4
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:P/I:N/A:N
jordan@liggitt.net 2.2 0.7 1.4
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

https://github.com/kubernetes/kubernetes/issues/101493
Third Party Advisory
Issue Tracking
Mitigation
https://groups.google.com/g/kubernetes-security-announce/c/-MFX60_wdOY
Third Party Advisory
Mailing List
https://security.netapp.com/advisory/ntap-20220225-0002/
Third Party Advisory
https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves/