Bug 731800

Summary:	<sys-cluster/kubernetes-{1.16.11,1.17.7,1.18.4}: Improper local network isolation (CVE-2020-8558)
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	williamh
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/kubernetes/kubernetes/issues/92315
Whiteboard:	B4 [noglsa]
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	731802

Description John Helmert III archtester

2020-07-09 00:52:57 UTC

CVE-2020-8558:

A security issue was discovered in kube-proxy which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. For example, if a cluster administrator runs a TCP service on a node that listens on 127.0.0.1:1234, because of this bug, that service would be potentially reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service. If the example service on port 1234 required no additional authentication (because it assumed that only other localhost processes could reach it), then it could be vulnerable to attacks that make use of this bug.



Maintainer, please stabilize when ready.

Comment 1 Larry the Git Cow gentoo-dev

2020-07-11 17:47:14 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=58d831db94fe3d5752d3a54e08d158c6f477d424

commit 58d831db94fe3d5752d3a54e08d158c6f477d424
Author:     William Hubbs <williamh@gentoo.org>
AuthorDate: 2020-07-11 17:36:54 +0000
Commit:     William Hubbs <williamh@gentoo.org>
CommitDate: 2020-07-11 17:44:29 +0000

    sys-cluster/kubernetes: stable 1.16.11, 1.17.7 and 1.18.4 on amd64
    
    Bug: https://bugs.gentoo.org/731800
    Signed-off-by: William Hubbs <williamh@gentoo.org>

 sys-cluster/kubernetes/kubernetes-1.16.11.ebuild | 2 +-
 sys-cluster/kubernetes/kubernetes-1.17.7.ebuild  | 2 +-
 sys-cluster/kubernetes/kubernetes-1.18.4.ebuild  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

Comment 2 Larry the Git Cow gentoo-dev

2020-07-11 18:38:47 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b4b92d0a9acab2111536710a237a05e381f521e9

commit b4b92d0a9acab2111536710a237a05e381f521e9
Author:     William Hubbs <williamh@gentoo.org>
AuthorDate: 2020-07-11 18:32:15 +0000
Commit:     William Hubbs <williamh@gentoo.org>
CommitDate: 2020-07-11 18:38:21 +0000

    sys-cluster/kubernetes: remove vulnerable versions
    
    Bug: https://bugs.gentoo.org/731800
    Signed-off-by: William Hubbs <williamh@gentoo.org>

 sys-cluster/kubernetes/Manifest                  | 10 ---
 sys-cluster/kubernetes/kubernetes-1.16.10.ebuild | 90 ------------------------
 sys-cluster/kubernetes/kubernetes-1.16.8.ebuild  | 90 ------------------------
 sys-cluster/kubernetes/kubernetes-1.16.9.ebuild  | 90 ------------------------
 sys-cluster/kubernetes/kubernetes-1.17.4.ebuild  | 90 ------------------------
 sys-cluster/kubernetes/kubernetes-1.17.5.ebuild  | 90 ------------------------
 sys-cluster/kubernetes/kubernetes-1.17.6.ebuild  | 90 ------------------------
 sys-cluster/kubernetes/kubernetes-1.18.0.ebuild  | 90 ------------------------
 sys-cluster/kubernetes/kubernetes-1.18.1.ebuild  | 90 ------------------------
 sys-cluster/kubernetes/kubernetes-1.18.2.ebuild  | 90 ------------------------
 sys-cluster/kubernetes/kubernetes-1.18.3.ebuild  | 90 ------------------------
 11 files changed, 910 deletions(-)

Comment 3 John Helmert III archtester

2020-07-11 18:45:50 UTC

Thanks, William.