Security Bulletin
Summary
IBM Cloud Kubernetes Service is affected by a Kubernetes Ingress Controller security vulnerability where a user that can create or update Ingress objects can use the custom snippets feature to obtain all secrets in the cluster (CVE-2021-25742).
This vulnerability is relevant mainly in multi-tenant environments where non-admin users have permissions to create Ingress objects.
Vulnerability Details
CVEID: CVE-2021-25742
Description: Kubernetes NGINX Ingress Controller could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in the custom snippets feature. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain all secrets in the cluster, and use this information to launch further attacks against the affected system.
CVSS Base Score: 7.6
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/211838 for more information
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Affected Products and Versions
IBM Cloud Kubernetes Service clusters with Kubernetes Ingress application load balancers (ALBs) with versions:
- <= 0.48.1_1698_iks
- 1.0.0_1699_iks
Remediation/Fixes
Updates for ALBs are available that fix this vulnerability. By default, automatic updates to Ingress ALBs are enabled, therefore ALBs are automatically updated by IBM when a new default image version is available.
Use the following IBM Cloud CLI command to see the version of your ALBs:
ibmcloud ks ingress alb ls
If the versions are at one of the following versions or later, the ALBs have the fix:
If automatic updates for the Ingress ALBs are disabled, you can force a one-time update of your ALBs with the following command:
ibmcloud ks ingress alb update
After you force a one-time update, automatic updates remain disabled, but can be re-enabled with the command:
ibmcloud ks ingress alb autoupdate enable
The new versions provide a new configuration parameter (allow-snippet-annotations) which allows clusters administrators to disable the custom snippets feature.
When when the custom snippets feature is disabled, the nginx.ingress.kubernetes.io/configuration-snippet and nginx.ingress.kubernetes.io/server-snippet annotations will be ignored by the ALBs.
Action Required:
Customers must:
- update to one of the listed Kubernetes Ingress ALB versions
- validate the Ingress configurations before disabling the feature Note
- update the controller's ConfigMap (
kube-system/ibm-k8s-controller-config) withallow-snippet-annotations: "false".
nginx.ingress.kubernetes.io/configuration-snippet annotation, therefore the allow-snippet-annotations: "false" configuration to remediate this vulnerability is incompatible with the add-on.Monitor IBM Cloud Status for Future Security Bulletins
Monitor the security notifications on the IBM Cloud Status page to be advised of future security bulletins.
References
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Internal Use Only
Was this topic helpful?
Document Information
Modified date:
22 October 2021
UID
ibm16501909