CVE-2020-8554
Fixed in a distro release EPSS 9%CVSS 6.3
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.
Products: Kubernetes
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | k8s.io/kubernetes | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | kube-apiserver-1.28 | 0 |
| Chainguard | kube-apiserver-1.28-default | 0 |
| Chainguard | kube-apiserver-1.29 | 0 |
| Chainguard | kube-apiserver-1.29-default | 0 |
| Chainguard | kube-apiserver-1.30 | 0 |
| Chainguard | kube-apiserver-1.30-default | 0 |
| Chainguard | kube-apiserver-1.31 | 0 |
| Chainguard | kube-apiserver-1.31-default | 0 |
| Chainguard | kube-controller-manager-1.28 | 0 |
| Chainguard | kube-controller-manager-1.28-default | 0 |
| Chainguard | kube-controller-manager-1.29 | 0 |
| Chainguard | kube-controller-manager-1.29-default | 0 |
| Chainguard | kube-controller-manager-1.30 | 0 |
| Chainguard | kube-controller-manager-1.30-default | 0 |
| Chainguard | kube-controller-manager-1.31 | 0 |
| Chainguard | kube-controller-manager-1.31-default | 0 |
| Chainguard | kube-proxy-1.28 | 0 |
| Chainguard | kube-proxy-1.28-default | 0 |
| Chainguard | kube-proxy-1.29 | 0 |
| Chainguard | kube-proxy-1.29-default | 0 |
| Chainguard | kube-proxy-1.29-default-compat | 0 |
| Chainguard | kube-proxy-1.30 | 0 |
| Chainguard | kube-proxy-1.30-default | 0 |
| Chainguard | kube-proxy-1.30-default-compat | 0 |
| Chainguard | kube-proxy-1.31 | 0 |
| Chainguard | kube-proxy-1.31-default | 0 |
| Chainguard | kube-proxy-1.31-default-compat | 0 |
| Chainguard | kube-scheduler-1.28 | 0 |
| Chainguard | kube-scheduler-1.28-default | 0 |
| Chainguard | kube-scheduler-1.29 | 0 |
| Chainguard | kube-scheduler-1.29-default | 0 |
| Chainguard | kube-scheduler-1.30 | 0 |
| Chainguard | kube-scheduler-1.30-default | 0 |
| Chainguard | kube-scheduler-1.31 | 0 |
| Chainguard | kube-scheduler-1.31-default | 0 |
| Chainguard | kubeadm-1.28 | 0 |
| Chainguard | kubeadm-1.28-default | 0 |
| Chainguard | kubeadm-1.29 | 0 |
| Chainguard | kubeadm-1.29-default | 0 |
| Chainguard | kubeadm-1.30 | 0 |
| Chainguard | kubeadm-1.30-default | 0 |
| Chainguard | kubeadm-1.31 | 0 |
| Chainguard | kubeadm-1.31-default | 0 |
| Chainguard | kubectl-1.28 | 0 |
| Chainguard | kubectl-1.28-default | 0 |
| Chainguard | kubectl-1.29 | 0 |
| Chainguard | kubectl-1.29-bitnami-compat | 0 |
| Chainguard | kubectl-1.29-default | 0 |
| Chainguard | kubectl-1.30 | 0 |
| Chainguard | kubectl-1.30-bitnami-compat | 0 |
| Chainguard | kubectl-1.30-default | 0 |
| Chainguard | kubectl-1.31 | 0 |
| Chainguard | kubectl-1.31-bitnami-compat | 0 |
| Chainguard | kubectl-1.31-default | 0 |
| Chainguard | kubectl-bash-completion-1.28 | 0 |
| Chainguard | kubectl-bash-completion-1.29 | 0 |
| Chainguard | kubectl-bash-completion-1.30 | 0 |
| Chainguard | kubectl-bash-completion-1.31 | 0 |
| Chainguard | kubeflow-pipelines | 0 |
| Chainguard | kubeflow-pipelines-apiserver | 0 |
| Chainguard | kubeflow-pipelines-cache-deployer | 0 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 0 |
| Chainguard | kubeflow-pipelines-cache_server | 0 |
| Chainguard | kubeflow-pipelines-frontend | 0 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 0 |
| Chainguard | kubeflow-pipelines-metadata-writer | 0 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 0 |
| Chainguard | kubeflow-pipelines-persistence_agent | 0 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 0 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 0 |
| Chainguard | kubelet-1.28 | 0 |
| Chainguard | kubelet-1.28-default | 0 |
| Chainguard | kubelet-1.29 | 0 |
| Chainguard | kubelet-1.29-default | 0 |
| Chainguard | kubelet-1.30 | 0 |
| Chainguard | kubelet-1.30-default | 0 |
| Chainguard | kubelet-1.31 | 0 |
| Chainguard | kubelet-1.31-default | 0 |
| Chainguard | kubernetes-1.21 | 0 |
| Chainguard | kubernetes-1.22 | 0 |
| Chainguard | kubernetes-1.23 | 0 |
| Chainguard | kubernetes-1.24 | 0 |
| Chainguard | kubernetes-1.26 | 0 |
| Chainguard | kubernetes-1.27 | 0 |
| Chainguard | kubernetes-1.28 | 0 |
| Chainguard | kubernetes-1.28-default | 0 |
| Chainguard | kubernetes-1.29 | 0 |
| Chainguard | kubernetes-1.29-default | 0 |
| Chainguard | kubernetes-1.30 | 0 |
| Chainguard | kubernetes-1.30-default | 0 |
| Chainguard | kubernetes-1.31 | 0 |
| Chainguard | kubernetes-1.31-default | 0 |
| Chainguard | kubernetes-1.32 | 0 |
| Chainguard | kubernetes-1.33 | no fix |
| Chainguard | kubernetes-1.34 | no fix |
| Chainguard | kubernetes-1.35 | no fix |
| Chainguard | kubernetes-1.36 | no fix |
| Chainguard | kubernetes-1.37 | no fix |
| Chainguard | kubernetes-dns-node-cache-1.17 | 0 |
| Chainguard | kubernetes-pause-1.29 | 0 |
| Chainguard | kubernetes-pause-1.30 | 0 |
| Chainguard | kubernetes-pause-1.31 | 0 |
| Chainguard | kubernetes-pause-compat-1.29 | 0 |
| Chainguard | kubernetes-pause-compat-1.30 | 0 |
| Chainguard | kubernetes-pause-compat-1.31 | 0 |
| Chainguard | nodetaint | 0 |
| Chainguard | spark-operator | 0 |
| Chainguard | spark-operator-oci-entrypoint | 0 |
| Chainguard | sparkctl | 0 |
| Debian 13 | kubernetes | 1.31.4+ds-1 |
| Debian 14 | kubernetes | 1.31.4+ds-1 |
| Red Hat openshift 3.11 | atomic-enterprise-service-catalog | 1:3.11.374-1.git.1675.738abcc.el7 |
| Red Hat openshift 3.11 | atomic-enterprise-service-catalog-svcat | 1:3.11.374-1.git.1675.738abcc.el7 |
| Red Hat openshift 3.11 | atomic-openshift | 0:3.11.374-1.git.0.ebd3ee9.el7 |
| Red Hat openshift 3.11 | atomic-openshift-clients | 0:3.11.374-1.git.0.ebd3ee9.el7 |
| Red Hat openshift 3.11 | atomic-openshift-clients-redistributable | 0:3.11.374-1.git.0.ebd3ee9.el7 |
| Red Hat openshift 3.11 | atomic-openshift-cluster-autoscaler | 0:3.11.374-1.git.0.2996f62.el7 |
| Red Hat openshift 3.11 | atomic-openshift-descheduler | 0:3.11.374-1.git.299.f128e96.el7 |
| Red Hat openshift 3.11 | atomic-openshift-docker-excluder | 0:3.11.374-1.git.0.ebd3ee9.el7 |
| Red Hat openshift 3.11 | atomic-openshift-dockerregistry | 0:3.11.374-1.git.481.e6a880c.el7 |
| Red Hat openshift 3.11 | atomic-openshift-excluder | 0:3.11.374-1.git.0.ebd3ee9.el7 |
| Red Hat openshift 3.11 | atomic-openshift-hyperkube | 0:3.11.374-1.git.0.ebd3ee9.el7 |
| Red Hat openshift 3.11 | atomic-openshift-hypershift | 0:3.11.374-1.git.0.ebd3ee9.el7 |
| Red Hat openshift 3.11 | atomic-openshift-master | 0:3.11.374-1.git.0.ebd3ee9.el7 |
| Red Hat openshift 3.11 | atomic-openshift-metrics-server | 0:3.11.374-1.git.53.9df25a9.el7 |
| Red Hat openshift 3.11 | atomic-openshift-node | 0:3.11.374-1.git.0.ebd3ee9.el7 |
| Red Hat openshift 3.11 | atomic-openshift-node-problem-detector | 0:3.11.374-1.git.263.28335fb.el7 |
| Red Hat openshift 3.11 | atomic-openshift-pod | 0:3.11.374-1.git.0.ebd3ee9.el7 |
| Red Hat openshift 3.11 | atomic-openshift-sdn-ovs | 0:3.11.374-1.git.0.ebd3ee9.el7 |
| Red Hat openshift 3.11 | atomic-openshift-service-idler | 0:3.11.374-1.git.15.523a1f7.el7 |
| Red Hat openshift 3.11 | atomic-openshift-template-service-broker | 0:3.11.374-1.git.0.ebd3ee9.el7 |
| Red Hat openshift 3.11 | atomic-openshift-tests | 0:3.11.374-1.git.0.ebd3ee9.el7 |
| Red Hat openshift 3.11 | atomic-openshift-web-console | 0:3.11.374-1.git.647.9e78d83.el7 |
| Red Hat openshift 3.11 | golang-github-openshift-oauth-proxy | 0:3.11.374-1.git.439.966c536.el7 |
| Red Hat openshift 3.11 | golang-github-prometheus-alertmanager | 0:3.11.374-1.git.0.3abd2a5.el7 |
| Red Hat openshift 3.11 | golang-github-prometheus-node_exporter | 0:3.11.374-1.git.1062.490d6d5.el7 |
| Red Hat openshift 3.11 | golang-github-prometheus-prometheus | 0:3.11.374-1.git.5026.29379c4.el7 |
| Red Hat openshift 3.11 | openshift-enterprise-autoheal | 0:3.11.374-1.git.218.9cf7939.el7 |
| Red Hat openshift 3.11 | openshift-enterprise-cluster-capacity | 0:3.11.374-1.git.379.80bd08f.el7 |
| Red Hat openshift 3.11 | prometheus | 0:3.11.374-1.git.5026.29379c4.el7 |
| Red Hat openshift 3.11 | prometheus-alertmanager | 0:3.11.374-1.git.0.3abd2a5.el7 |
| Red Hat openshift 3.11 | prometheus-node-exporter | 0:3.11.374-1.git.1062.490d6d5.el7 |
| Red Hat openshift 3.11 | python-urllib3 | 0:1.26.2-1.el7 |
| Red Hat openshift 3.11 | python2-urllib3 | 0:1.26.2-1.el7 |
| Ubuntu 22.04 LTS | kubernetes | no fix |
| Ubuntu 24.04 LTS | kubernetes | no fix |
| Ubuntu Pro 20.04 LTS | kubernetes | no fix |
| Wolfi | kube-apiserver-1.28 | 0 |
| Wolfi | kube-apiserver-1.28-default | 0 |
| Wolfi | kube-controller-manager-1.28 | 0 |
| Wolfi | kube-controller-manager-1.28-default | 0 |
| Wolfi | kube-proxy-1.28 | 0 |
| Wolfi | kube-proxy-1.28-default | 0 |
| Wolfi | kube-scheduler-1.28 | 0 |
| Wolfi | kube-scheduler-1.28-default | 0 |
| Wolfi | kubeadm-1.28 | 0 |
| Wolfi | kubeadm-1.28-default | 0 |
| Wolfi | kubectl-1.28 | 0 |
| Wolfi | kubectl-1.28-default | 0 |
| Wolfi | kubectl-bash-completion-1.28 | 0 |
| Wolfi | kubeflow-pipelines | 0 |
| Wolfi | kubeflow-pipelines-apiserver | 0 |
| Wolfi | kubeflow-pipelines-cache-deployer | 0 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 0 |
| Wolfi | kubeflow-pipelines-cache_server | 0 |
| Wolfi | kubeflow-pipelines-frontend | 0 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 0 |
| Wolfi | kubeflow-pipelines-metadata-writer | 0 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 0 |
| Wolfi | kubeflow-pipelines-persistence_agent | 0 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 0 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 0 |
| Wolfi | kubelet-1.28 | 0 |
| Wolfi | kubelet-1.28-default | 0 |
| Wolfi | kubernetes-1.26 | 0 |
| Wolfi | kubernetes-1.27 | 0 |
| Wolfi | kubernetes-1.28 | 0 |
| Wolfi | kubernetes-1.28-default | 0 |
| Wolfi | kubernetes-1.34 | no fix |
| Wolfi | kubernetes-1.35 | no fix |
| Wolfi | kubernetes-1.36 | no fix |
| Wolfi | kubernetes-1.37 | no fix |
| Wolfi | nodetaint | 0 |
| Wolfi | spark-operator | 0 |
| Wolfi | spark-operator-oci-entrypoint | 0 |
| Wolfi | sparkctl | 0 |