CVE-2020-8561
Fixed in a distro release EPSS 2%CVSS 4.1
A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.
Products: Kubernetes
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | k8s.io/kubernetes | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | kube-apiserver | no fix |
| Chainguard | kubeflow-pipelines | 0 |
| Chainguard | kubeflow-pipelines-apiserver | 0 |
| Chainguard | kubeflow-pipelines-cache-deployer | 0 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 0 |
| Chainguard | kubeflow-pipelines-cache_server | 0 |
| Chainguard | kubeflow-pipelines-frontend | 0 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 0 |
| Chainguard | kubeflow-pipelines-metadata-writer | 0 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 0 |
| Chainguard | kubeflow-pipelines-persistence_agent | 0 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 0 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 0 |
| Chainguard | kubernetes-dns-node-cache-1.17 | 0 |
| Chainguard | nodetaint | 0 |
| Chainguard | spark-operator | 0 |
| Chainguard | spark-operator-oci-entrypoint | 0 |
| Chainguard | sparkctl | 0 |
| Debian 12 | kubernetes | 1.20.5+really1.20.2-1 |
| Debian 13 | kubernetes | 1.20.5+really1.20.2-1 |
| Debian 14 | kubernetes | 1.20.5+really1.20.2-1 |
| Ubuntu 22.04 LTS | kubernetes | no fix |
| Ubuntu 24.04 LTS | kubernetes | no fix |
| Ubuntu Pro 20.04 LTS | kubernetes | no fix |
| Wolfi | kubeflow-pipelines | 0 |
| Wolfi | kubeflow-pipelines-apiserver | 0 |
| Wolfi | kubeflow-pipelines-cache-deployer | 0 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 0 |
| Wolfi | kubeflow-pipelines-cache_server | 0 |
| Wolfi | kubeflow-pipelines-frontend | 0 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 0 |
| Wolfi | kubeflow-pipelines-metadata-writer | 0 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 0 |
| Wolfi | kubeflow-pipelines-persistence_agent | 0 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 0 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 0 |
| Wolfi | nodetaint | 0 |
| Wolfi | spark-operator | 0 |
| Wolfi | spark-operator-oci-entrypoint | 0 |
| Wolfi | sparkctl | 0 |
| openSUSE Tumbleweed | kubernetes1.33 | 1.33.13-2.1 |
| openSUSE Tumbleweed | kubernetes1.34 | 1.34.10-1.1 |
| openSUSE Tumbleweed | kubernetes1.35 | 1.35.7-1.1 |
| openSUSE Tumbleweed | kubernetes1.36 | 1.36.3-1.1 |