Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes Ingress Controller security vulnerability (CVE-2021-25748)

Security Bulletin

Summary

IBM Cloud Kubernetes Service is affected by a Kubernetes Ingress Controller security vulnerability where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller.

This vulnerability is relevant mainly in multi-tenant environments where non-admin users have permissions to create Ingress objects.

Vulnerability Details

CVEID: CVE-2021-25748
Description: Ingress-nginx could allow a remote authenticated attacker to bypass security restrictions, caused by improper input validation. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass the sanitization of the `spec.rules[].http.paths[].path` field of an Ingress object.
CVSS Base Score: 7.6
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/228522 for more information
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)

Affected Products and Versions

IBM Cloud Kubernetes Service clusters with Kubernetes Ingress application load balancers (ALBs) with versions below 1.2.1_2337_iks

Remediation/Fixes

ALB version 1.2.1_2337_iks contains fixes for this vulnerability and is available immediately. If you have autoupdates enabled, the fixed version will be automatically applied to all ALBs in your cluster.

If automatic updates for the Ingress ALBs are disabled, you can force a one-time update of your ALBs with the following command:

ibmcloud ks ingress alb update --version 1.2.1_2337_iks

After you force a one-time update, automatic updates remain disabled, but can be re-enabled with the command:

ibmcloud ks ingress alb autoupdate enable

Monitor IBM Cloud Status for Future Security Bulletins

Monitor the security notifications on the IBM Cloud Status page to be advised of future security bulletins.

References

Complete CVSS v3 Guide
On-line Calculator v3

Off

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSJTBP","label":"IBM Cloud Kubernetes Service and Red Hat OpenShift on IBM Cloud"},"Component":"--","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB21","label":"Public Cloud Platform"}}]

Tips

Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes Ingress Controller security vulnerability (CVE-2021-25748)