Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Protecting Against an Unfixed Kubernetes Man-in-the-Middle Vulnerability (CVE-2020-8554)

Summary: On Dec. 4, 2020, the Kubernetes Product Security Committee disclosed CVE-2020-8554, a medium-severity design flaw affecting all Kubernetes versions that remains unpatched, allowing users who can manage services to assign arbitrary External IPs and Load Balancer IPs and intercept cluster traffic to any IP address. The committee declined to patch it because a fix would change functionality of features users rely on, recommending instead mitigations such as a custom admission controller or an OPA Gatekeeper rule, with no mitigation offered for Load Balancer IPs.

Why it matters: A tenant restricted to its own namespace can still use this flaw to eavesdrop on traffic from the entire cluster, so namespace isolation does not contain a compromised tenant. The committee has no short-term plan to patch, leaving admission-control rules and TLS enforcement as the only barriers.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2020-8554
Related