CVE-2020-8562
lowPriorität · verfolgen · 12EPSS 0.012 · 68. PerzentilDEEUFRRUUSEPSS · bewertet 2026-10-27
As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (17)
Betroffene Produkte und Versionsbereiche.
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2024-1488IBM InfoSphere Information Server: Mehrere SchwachstellenDeutsch2024-06-30csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.
- GHSA-qh36-44jv-c8xjPotential proxy IP restriction bypass in Kubernetes2022-02-02ghsa · osvUS
As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. All versions of Kubernetes are impacted, and there is no fix in place.
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
- GO-2022-0617WITHDRAWN: Potential proxy IP restriction bypass in Kubernetes in k8s.io/kubernetes2024-08-21vendor · osvUS
(This report has been withdrawn from the Go vulnerability database with reason: "Low severity issue with no fix available or planned. Likely to cause false positives.").
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (15)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2020-8562cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=1954914Patchcnnvd
- https://github.com/kubernetes/kubernetes/issues/101493cnnvd
- https://groups.google.com/g/kubernetes-security-announce/c/-MFX60_wdOYcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-8562cnnvd
- https://security.netapp.com/advisory/ntap-20220225-0002/cnnvd
- https://vigilance.fr/vulnerability/Kubernetes-privilege-escalation-35243cnnvd
- https://github.com/kubernetes/kubernetes/issues/101493enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan