CVE-2021-25735
Fixed in a distro release EPSS 5%CVSS 6.5
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.
Products: Kubernetes
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | k8s.io/kubernetes | 1.20.6 |
| Go | k8s.io/kubernetes | 1.19.10 |
| Go | k8s.io/kubernetes | 1.18.18 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | kubeflow-pipelines | 0 |
| Chainguard | kubeflow-pipelines-apiserver | 0 |
| Chainguard | kubeflow-pipelines-cache-deployer | 0 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 0 |
| Chainguard | kubeflow-pipelines-cache_server | 0 |
| Chainguard | kubeflow-pipelines-frontend | 0 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 0 |
| Chainguard | kubeflow-pipelines-metadata-writer | 0 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 0 |
| Chainguard | kubeflow-pipelines-persistence_agent | 0 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 0 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 0 |
| Chainguard | kubernetes-dns-node-cache-1.17 | 0 |
| Debian 12 | kubernetes | 1.20.5+really1.20.2-1 |
| Debian 13 | kubernetes | 1.20.5+really1.20.2-1 |
| Debian 14 | kubernetes | 1.20.5+really1.20.2-1 |
| Red Hat openshift 4.8 | afterburn | 0:5.0.0-1.rhaos4.8.el8 |
| Red Hat openshift 4.8 | afterburn-debuginfo | 0:5.0.0-1.rhaos4.8.el8 |
| Red Hat openshift 4.8 | atomic-openshift-service-idler | 0:4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8 |
| Red Hat openshift 4.8 | butane | 0:0.12.1-1.rhaos4.8.el8 |
| Red Hat openshift 4.8 | butane-debuginfo | 0:0.12.1-1.rhaos4.8.el8 |
| Red Hat openshift 4.8 | console-login-helper-messages | 0:0.20.3-1.rhaos4.8.el8 |
| Red Hat openshift 4.8 | console-login-helper-messages-issuegen | 0:0.20.3-1.rhaos4.8.el8 |
| Red Hat openshift 4.8 | console-login-helper-messages-profile | 0:0.20.3-1.rhaos4.8.el8 |
| Red Hat openshift 4.8 | coreos-installer | 0:0.9.0-6.rhaos4.8.el8 |
| Red Hat openshift 4.8 | coreos-installer-bootinfra | 0:0.9.0-6.rhaos4.8.el8 |
| Red Hat openshift 4.8 | coreos-installer-bootinfra-debuginfo | 0:0.9.0-6.rhaos4.8.el8 |
| Red Hat openshift 4.8 | coreos-installer-debuginfo | 0:0.9.0-6.rhaos4.8.el8 |
| Red Hat openshift 4.8 | coreos-installer-debugsource | 0:0.9.0-6.rhaos4.8.el8 |
| Red Hat openshift 4.8 | cri-o | 0:1.21.2-5.rhaos4.8.gitb27d974.el7 |
| Red Hat openshift 4.8 | cri-o | 0:1.21.2-5.rhaos4.8.gitb27d974.el8 |
| Red Hat openshift 4.8 | cri-o-debuginfo | 0:1.21.2-5.rhaos4.8.gitb27d974.el7 |
| Red Hat openshift 4.8 | cri-o-debuginfo | 0:1.21.2-5.rhaos4.8.gitb27d974.el8 |
| Red Hat openshift 4.8 | cri-o-debugsource | 0:1.21.2-5.rhaos4.8.gitb27d974.el8 |
| Red Hat openshift 4.8 | cri-tools | 0:1.21.0-2.el7 |
| Red Hat openshift 4.8 | cri-tools | 0:1.21.0-2.el8 |
| Red Hat openshift 4.8 | cri-tools-debuginfo | 0:1.21.0-2.el8 |
| Red Hat openshift 4.8 | cri-tools-debuginfo | 0:1.21.0-2.el7 |
| Red Hat openshift 4.8 | cri-tools-debugsource | 0:1.21.0-2.el8 |
| Red Hat openshift 4.8 | haproxy | 0:2.2.13-1.el8 |
| Red Hat openshift 4.8 | haproxy | 0:2.2.13-1.el7 |
| Red Hat openshift 4.8 | haproxy-debuginfo | 0:2.2.13-1.el7 |
| Red Hat openshift 4.8 | haproxy-debugsource | 0:2.2.13-1.el8 |
| Red Hat openshift 4.8 | ignition | 0:2.9.0-6.rhaos4.8.el8 |
| Red Hat openshift 4.8 | ignition-debuginfo | 0:2.9.0-6.rhaos4.8.el8 |
| Red Hat openshift 4.8 | ignition-debugsource | 0:2.9.0-6.rhaos4.8.el8 |
| Red Hat openshift 4.8 | ignition-validate | 0:2.9.0-6.rhaos4.8.el8 |
| Red Hat openshift 4.8 | ignition-validate-debuginfo | 0:2.9.0-6.rhaos4.8.el8 |
| Red Hat openshift 4.8 | ironic-images | 0:2021.1-20210614.1.el8 |
| Red Hat openshift 4.8 | ironic-images-all | 0:2021.1-20210614.1.el8 |
| Red Hat openshift 4.8 | ironic-images-ipa-ppc64le | 0:2021.1-20210614.1.el8 |
| Red Hat openshift 4.8 | ironic-images-ipa-x86_64 | 0:2021.1-20210614.1.el8 |
| Red Hat openshift 4.8 | jenkins | 0:2.289.1.1624020353-1.el8 |
| Red Hat openshift 4.8 | jenkins-2-plugins | 0:4.8.1624022417-1.el8 |
| Red Hat openshift 4.8 | kata-containers | 0:2.1.0-4.el8 |
| Red Hat openshift 4.8 | openshift | 0:4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7 |
| Red Hat openshift 4.8 | openshift | 0:4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8 |
| Red Hat openshift 4.8 | openshift-ansible | 0:4.8.0-202106281541.p0.git.626f7a3.assembly.stream.el7 |
| Red Hat openshift 4.8 | openshift-ansible-test | 0:4.8.0-202106281541.p0.git.626f7a3.assembly.stream.el7 |
| Red Hat openshift 4.8 | openshift-clients | 0:4.8.0-202106281541.p0.git.1077b05.assembly.stream.el8 |
| Red Hat openshift 4.8 | openshift-clients | 0:4.8.0-202106281541.p0.git.1077b05.assembly.stream.el7 |
| Red Hat openshift 4.8 | openshift-clients-redistributable | 0:4.8.0-202106281541.p0.git.1077b05.assembly.stream.el8 |
| Red Hat openshift 4.8 | openshift-clients-redistributable | 0:4.8.0-202106281541.p0.git.1077b05.assembly.stream.el7 |
| Red Hat openshift 4.8 | openshift-hyperkube | 0:4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8 |
| Red Hat openshift 4.8 | openshift-hyperkube | 0:4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7 |
| Red Hat openshift 4.8 | openshift-kuryr | 0:4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8 |
| Red Hat openshift 4.8 | openshift-kuryr-cni | 0:4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8 |
| Red Hat openshift 4.8 | openshift-kuryr-common | 0:4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8 |
| Red Hat openshift 4.8 | openshift-kuryr-controller | 0:4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8 |
| Red Hat openshift 4.8 | openstack-ironic | 1:17.0.4-0.20210713221218.a415e7e.el8 |
| Red Hat openshift 4.8 | openstack-ironic-api | 1:17.0.4-0.20210713221218.a415e7e.el8 |
| Red Hat openshift 4.8 | openstack-ironic-common | 1:17.0.4-0.20210713221218.a415e7e.el8 |
| Red Hat openshift 4.8 | openstack-ironic-conductor | 1:17.0.4-0.20210713221218.a415e7e.el8 |
| Red Hat openshift 4.8 | openstack-ironic-inspector | 0:10.6.1-0.20210406091336.579f59c.el8 |
| Red Hat openshift 4.8 | openstack-ironic-inspector-api | 0:10.6.1-0.20210406091336.579f59c.el8 |
| Red Hat openshift 4.8 | openstack-ironic-inspector-conductor | 0:10.6.1-0.20210406091336.579f59c.el8 |
| Red Hat openshift 4.8 | openstack-ironic-inspector-dnsmasq | 0:10.6.1-0.20210406091336.579f59c.el8 |
| Red Hat openshift 4.8 | openstack-ironic-python-agent | 0:7.0.2-0.20210611153100.bfa97cb.el8 |
| Red Hat openshift 4.8 | openvswitch2.15 | 0:2.15.0-9.el8fdp |
| Red Hat openshift 4.8 | openvswitch2.15-debuginfo | 0:2.15.0-9.el8fdp |
| Red Hat openshift 4.8 | openvswitch2.15-devel | 0:2.15.0-9.el8fdp |
| Red Hat openshift 4.8 | openvswitch2.15-ipsec | 0:2.15.0-9.el8fdp |
| Red Hat openshift 4.8 | ostree | 0:2020.7-5.el8_4 |
| Red Hat openshift 4.8 | ostree-debuginfo | 0:2020.7-5.el8_4 |
| Red Hat openshift 4.8 | ostree-debugsource | 0:2020.7-5.el8_4 |
| Red Hat openshift 4.8 | ostree-devel | 0:2020.7-5.el8_4 |
| Red Hat openshift 4.8 | ostree-grub2 | 0:2020.7-5.el8_4 |
| Red Hat openshift 4.8 | ostree-libs | 0:2020.7-5.el8_4 |
| Red Hat openshift 4.8 | ostree-libs-debuginfo | 0:2020.7-5.el8_4 |
| Red Hat openshift 4.8 | ovn2.13 | 0:20.12.0-25.el8fdp |
| Red Hat openshift 4.8 | ovn2.13-central | 0:20.12.0-25.el8fdp |
| Red Hat openshift 4.8 | ovn2.13-central-debuginfo | 0:20.12.0-25.el8fdp |
| Red Hat openshift 4.8 | ovn2.13-debuginfo | 0:20.12.0-25.el8fdp |
| Red Hat openshift 4.8 | ovn2.13-debugsource | 0:20.12.0-25.el8fdp |
| Red Hat openshift 4.8 | ovn2.13-host | 0:20.12.0-25.el8fdp |
| Red Hat openshift 4.8 | ovn2.13-host-debuginfo | 0:20.12.0-25.el8fdp |
| Red Hat openshift 4.8 | ovn2.13-vtep | 0:20.12.0-25.el8fdp |
| Red Hat openshift 4.8 | ovn2.13-vtep-debuginfo | 0:20.12.0-25.el8fdp |
| Red Hat openshift 4.8 | podman | 0:3.0.1-6.el8 |
| Red Hat openshift 4.8 | podman-catatonit-debuginfo | 0:3.0.1-6.el8 |
| Red Hat openshift 4.8 | podman-debuginfo | 0:3.0.1-6.el8 |
| Red Hat openshift 4.8 | podman-debugsource | 0:3.0.1-6.el8 |
| Red Hat openshift 4.8 | podman-docker | 0:3.0.1-6.el8 |
| Red Hat openshift 4.8 | podman-plugins-debuginfo | 0:3.0.1-6.el8 |
| Red Hat openshift 4.8 | podman-remote | 0:3.0.1-6.el8 |
| Red Hat openshift 4.8 | podman-remote-debuginfo | 0:3.0.1-6.el8 |
| Red Hat openshift 4.8 | podman-tests | 0:3.0.1-6.el8 |
| Red Hat openshift 4.8 | python-debtcollector | 0:2.2.0-0.20210324220630.649189d.el8 |
| Red Hat openshift 4.8 | python-eventlet | 0:0.25.2-4.el8 |
| Red Hat openshift 4.8 | python-hardware | 0:0.27.0-0.20210406121246.756fedb.el8 |
| Red Hat openshift 4.8 | python-ironic-lib | 0:4.6.2-0.20210608101214.ca2e4ba.el8 |
| Red Hat openshift 4.8 | python-ironic-prometheus-exporter | 0:2.2.1-0.20210325143713.70e39c8.el8 |
| Red Hat openshift 4.8 | python-jsonschema | 0:3.2.0-5.el8ost |
| Red Hat openshift 4.8 | python-keystoneauth1 | 0:4.3.0-0.20210325001456.6a66271.el8 |
| Red Hat openshift 4.8 | python-kubernetes | 0:12.0.1-1.el8 |
| Red Hat openshift 4.8 | python-openshift | 1:0.12.1-1.el8 |
| Red Hat openshift 4.8 | python-openstacksdk | 0:0.53.0-0.20210325011601.4629245.el8 |
| Red Hat openshift 4.8 | python-oslo-concurrency | 0:4.4.0-0.20210325004915.7dcf9e9.el8 |
| Red Hat openshift 4.8 | python-oslo-concurrency-lang | 0:4.4.0-0.20210325004915.7dcf9e9.el8 |
| Red Hat openshift 4.8 | python-oslo-config | 2:8.5.0-0.20210325050501.cfa2564.el8 |
| Red Hat openshift 4.8 | python-oslo-context | 0:3.2.0-0.20210325043103.0d02866.el8 |
| Red Hat openshift 4.8 | python-oslo-db | 0:8.5.0-0.20210325041241.503db60.el8 |
| Red Hat openshift 4.8 | python-oslo-db-lang | 0:8.5.0-0.20210325041241.503db60.el8 |
| Red Hat openshift 4.8 | python-oslo-i18n | 0:5.0.1-0.20210324221600.73187bd.el8 |
| Red Hat openshift 4.8 | python-oslo-i18n-lang | 0:5.0.1-0.20210324221600.73187bd.el8 |
| Red Hat openshift 4.8 | python-oslo-log | 0:4.4.0-0.20210409081224.9b29c90.el8 |
| Red Hat openshift 4.8 | python-oslo-log-lang | 0:4.4.0-0.20210409081224.9b29c90.el8 |
| Red Hat openshift 4.8 | python-oslo-policy | 0:3.7.0-0.20210325051823.d853485.el8 |
| Red Hat openshift 4.8 | python-oslo-policy-lang | 0:3.7.0-0.20210325051823.d853485.el8 |
| Red Hat openshift 4.8 | python-oslo-serialization | 0:4.1.0-0.20210325012242.8445e61.el8 |
| Red Hat openshift 4.8 | python-oslo-service | 0:2.5.0-0.20210325014731.d25e454.el8 |
| Red Hat openshift 4.8 | python-oslo-upgradecheck | 0:1.3.0-0.20210325003851.9f95a6e.el8 |
| Red Hat openshift 4.8 | python-oslo-utils | 0:4.8.0-0.20210325043201.3288539.el8 |
| Red Hat openshift 4.8 | python-oslo-utils-lang | 0:4.8.0-0.20210325043201.3288539.el8 |
| Red Hat openshift 4.8 | python-pyrsistent | 0:0.16.0-3.el8ost |
| Red Hat openshift 4.8 | python-stevedore | 0:3.3.0-0.20210325001012.7d7154f.el8 |
| Red Hat openshift 4.8 | python-sushy | 0:3.7.1-0.20210428165244.bc49878.el8 |
| Red Hat openshift 4.8 | python-sushy-oem-idrac | 0:2.0.1-0.20210326152858.83b7eb0.el8 |
| Red Hat openshift 4.8 | python-tooz | 0:2.8.0-0.20210324235001.54448e9.el8 |
| Red Hat openshift 4.8 | python3-debtcollector | 0:2.2.0-0.20210324220630.649189d.el8 |
| Red Hat openshift 4.8 | python3-eventlet | 0:0.25.2-4.el8 |
| Red Hat openshift 4.8 | python3-hardware | 0:0.27.0-0.20210406121246.756fedb.el8 |
| Red Hat openshift 4.8 | python3-hardware-detect | 0:0.27.0-0.20210406121246.756fedb.el8 |
| Red Hat openshift 4.8 | python3-ironic-inspector-tests | 0:10.6.1-0.20210406091336.579f59c.el8 |
| Red Hat openshift 4.8 | python3-ironic-lib | 0:4.6.2-0.20210608101214.ca2e4ba.el8 |
| Red Hat openshift 4.8 | python3-ironic-prometheus-exporter | 0:2.2.1-0.20210325143713.70e39c8.el8 |
| Red Hat openshift 4.8 | python3-ironic-python-agent | 0:7.0.2-0.20210611153100.bfa97cb.el8 |
| Red Hat openshift 4.8 | python3-ironic-tests | 1:17.0.4-0.20210713221218.a415e7e.el8 |
| Red Hat openshift 4.8 | python3-jsonschema | 0:3.2.0-5.el8ost |
| Red Hat openshift 4.8 | python3-keystoneauth1 | 0:4.3.0-0.20210325001456.6a66271.el8 |
| Red Hat openshift 4.8 | python3-kubernetes | 0:12.0.1-1.el8 |
| Red Hat openshift 4.8 | python3-kubernetes-tests | 0:12.0.1-1.el8 |
| Red Hat openshift 4.8 | python3-kuryr-kubernetes | 0:4.8.0-202106281541.p0.git.8a4c2d8.assembly.stream.el8 |
| Red Hat openshift 4.8 | python3-openshift | 1:0.12.1-1.el8 |
| Red Hat openshift 4.8 | python3-openstacksdk | 0:0.53.0-0.20210325011601.4629245.el8 |
| Red Hat openshift 4.8 | python3-openstacksdk-tests | 0:0.53.0-0.20210325011601.4629245.el8 |
| Red Hat openshift 4.8 | python3-openvswitch2.15 | 0:2.15.0-9.el8fdp |
| Red Hat openshift 4.8 | python3-openvswitch2.15-debuginfo | 0:2.15.0-9.el8fdp |
| Red Hat openshift 4.8 | python3-oslo-concurrency | 0:4.4.0-0.20210325004915.7dcf9e9.el8 |
| Red Hat openshift 4.8 | python3-oslo-concurrency-tests | 0:4.4.0-0.20210325004915.7dcf9e9.el8 |
| Red Hat openshift 4.8 | python3-oslo-config | 2:8.5.0-0.20210325050501.cfa2564.el8 |
| Red Hat openshift 4.8 | python3-oslo-context | 0:3.2.0-0.20210325043103.0d02866.el8 |
| Red Hat openshift 4.8 | python3-oslo-db | 0:8.5.0-0.20210325041241.503db60.el8 |
| Red Hat openshift 4.8 | python3-oslo-db-tests | 0:8.5.0-0.20210325041241.503db60.el8 |
| Red Hat openshift 4.8 | python3-oslo-i18n | 0:5.0.1-0.20210324221600.73187bd.el8 |
| Red Hat openshift 4.8 | python3-oslo-log | 0:4.4.0-0.20210409081224.9b29c90.el8 |
| Red Hat openshift 4.8 | python3-oslo-log-tests | 0:4.4.0-0.20210409081224.9b29c90.el8 |
| Red Hat openshift 4.8 | python3-oslo-policy | 0:3.7.0-0.20210325051823.d853485.el8 |
| Red Hat openshift 4.8 | python3-oslo-serialization | 0:4.1.0-0.20210325012242.8445e61.el8 |
| Red Hat openshift 4.8 | python3-oslo-serialization-tests | 0:4.1.0-0.20210325012242.8445e61.el8 |
| Red Hat openshift 4.8 | python3-oslo-service | 0:2.5.0-0.20210325014731.d25e454.el8 |
| Red Hat openshift 4.8 | python3-oslo-service-tests | 0:2.5.0-0.20210325014731.d25e454.el8 |
| Red Hat openshift 4.8 | python3-oslo-upgradecheck | 0:1.3.0-0.20210325003851.9f95a6e.el8 |
| Red Hat openshift 4.8 | python3-oslo-utils | 0:4.8.0-0.20210325043201.3288539.el8 |
| Red Hat openshift 4.8 | python3-oslo-utils-tests | 0:4.8.0-0.20210325043201.3288539.el8 |
| Red Hat openshift 4.8 | python3-pyrsistent | 0:0.16.0-3.el8ost |
| Red Hat openshift 4.8 | python3-pyrsistent-debuginfo | 0:0.16.0-3.el8ost |
| Red Hat openshift 4.8 | python3-stevedore | 0:3.3.0-0.20210325001012.7d7154f.el8 |
| Red Hat openshift 4.8 | python3-sushy | 0:3.7.1-0.20210428165244.bc49878.el8 |
| Red Hat openshift 4.8 | python3-sushy-oem-idrac | 0:2.0.1-0.20210326152858.83b7eb0.el8 |
| Red Hat openshift 4.8 | python3-sushy-oem-idrac-tests | 0:2.0.1-0.20210326152858.83b7eb0.el8 |
| Red Hat openshift 4.8 | python3-sushy-tests | 0:3.7.1-0.20210428165244.bc49878.el8 |
| Red Hat openshift 4.8 | python3-tooz | 0:2.8.0-0.20210324235001.54448e9.el8 |
| Red Hat openshift 4.8 | redhat-release-coreos | 0:48.84-4.el8 |
| Red Hat openshift 4.8 | rteval-loads | 0:1.4-12.el8 |
| Red Hat openshift 4.8 | rteval-loads-debugsource | 0:1.4-12.el8 |
| Red Hat openshift 4.8 | runc | 0:1.0.0-98.rhaos4.8.gitcd80260.el8 |
| Red Hat openshift 4.8 | runc | 0:1.0.0-98.rhaos4.8.gitcd80260.el7 |
| Red Hat openshift 4.8 | runc-debuginfo | 0:1.0.0-98.rhaos4.8.gitcd80260.el8 |
| Red Hat openshift 4.8 | runc-debuginfo | 0:1.0.0-98.rhaos4.8.gitcd80260.el7 |
| Red Hat openshift 4.8 | runc-debugsource | 0:1.0.0-98.rhaos4.8.gitcd80260.el8 |
| Red Hat openshift 4.8 | rust-afterburn | 0:5.0.0-1.rhaos4.8.el8 |
| Red Hat openshift 4.8 | rust-afterburn-debugsource | 0:5.0.0-1.rhaos4.8.el8 |
| Red Hat openshift 4.8 | stress-ng | 0:0.12.06-1.el8 |
| Red Hat openshift 4.8 | stress-ng-debuginfo | 0:0.12.06-1.el8 |
| Red Hat openshift 4.8 | toolbox | 0:0.0.8-3.rhaos4.8.el8 |
| Ubuntu 22.04 LTS | kubernetes | no fix |
| Ubuntu 24.04 LTS | kubernetes | no fix |
| Ubuntu Pro 20.04 LTS | kubernetes | no fix |
| Wolfi | kubeflow-pipelines | 0 |
| Wolfi | kubeflow-pipelines-apiserver | 0 |
| Wolfi | kubeflow-pipelines-cache-deployer | 0 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 0 |
| Wolfi | kubeflow-pipelines-cache_server | 0 |
| Wolfi | kubeflow-pipelines-frontend | 0 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 0 |
| Wolfi | kubeflow-pipelines-metadata-writer | 0 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 0 |
| Wolfi | kubeflow-pipelines-persistence_agent | 0 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 0 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 0 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 |