A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. You are only affected by this vulnerability if you run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object.

This issue has been rated **Medium** ([CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)), and assigned **CVE-2021-25735**.

**Note:** This only impacts validating admission plugins that rely on old values in certain fields, and does not impact calls from kubelets that go through the built-in NodeRestriction admission plugin.

#### Affected Versions

- kube-apiserver v1.20.0 - v1.20.5
- kube-apiserver v1.19.0 - v1.19.9
- kube-apiserver <= v1.18.17

#### Fixed Versions

This issue is fixed in the following versions:
- kube-apiserver v1.21.0 - Fixed by https://github.com/kubernetes/kubernetes/pull/99946
- kube-apiserver v1.20.6 - Fixed by https://github.com/kubernetes/kubernetes/pull/100315
- kube-apiserver v1.19.10 - Fixed by https://github.com/kubernetes/kubernetes/pull/100316
- kube-apiserver v1.18.18 - Fixed by https://github.com/kubernetes/kubernetes/pull/100317

#### Detection

If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io

#### Acknowledgements

This vulnerability was reported by Rogerio Bastos & Ari Lima from RedHat

CVE-2021-25735: Validating Admission Webhook does not observe some previous fields
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CVE-2021-25735: Validating Admission Webhook does not observe some previous fields
Issue date:

--- start body ---
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. You are only affected by this vulnerability if you run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object.

This issue has been rated **Medium** ([CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)), and assigned **CVE-2021-25735**.

**Note:** This only impacts validating admission plugins that rely on old values in certain fields, and does not impact calls from kubelets that go through the built-in NodeRestriction admission plugin.

#### Affected Versions

- kube-apiserver v1.20.0 - v1.20.5
- kube-apiserver v1.19.0 - v1.19.9
- kube-apiserver <= v1.18.17

#### Fixed Versions

This issue is fixed in the following versions:
- kube-apiserver v1.21.0 - Fixed by https://github.com/kubernetes/kubernetes/pull/99946
- kube-apiserver v1.20.6 - Fixed by https://github.com/kubernetes/kubernetes/pull/100315
- kube-apiserver v1.19.10 - Fixed by https://github.com/kubernetes/kubernetes/pull/100316
- kube-apiserver v1.18.18 - Fixed by https://github.com/kubernetes/kubernetes/pull/100317

#### Detection

If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io

#### Acknowledgements

This vulnerability was reported by Rogerio Bastos & Ari Lima from RedHat

--- end body ---
