From 4bff82205dc1c9d2b1dd218859d4c23acacf9e17 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adolfo=20Garc=C3=ADa=20Veytia=20=28Puerco=29?= Date: Wed, 15 Sep 2021 16:29:58 -0500 Subject: [PATCH] Add CVE 2021-25741 info to 1.19 release notes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This commit adds information about CVE 2021-25741 to the v1.19 changelog which did not make it into the document at release time. Signed-off-by: Adolfo García Veytia (Puerco) --- CHANGELOG/CHANGELOG-1.19.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/CHANGELOG/CHANGELOG-1.19.md b/CHANGELOG/CHANGELOG-1.19.md index 56c39052c91..d72e3163fe3 100644 --- a/CHANGELOG/CHANGELOG-1.19.md +++ b/CHANGELOG/CHANGELOG-1.19.md @@ -7,6 +7,8 @@ - [Server Binaries](#server-binaries) - [Node Binaries](#node-binaries) - [Changelog since v1.19.14](#changelog-since-v11914) + - [Important Security Information](#important-security-information) + - [CVE-2021-25741: Symlink Exchange Can Allow Host Filesystem Access](#cve-2021-25741-symlink-exchange-can-allow-host-filesystem-access) - [Changes by Kind](#changes-by-kind) - [Bug or Regression](#bug-or-regression) - [Other (Cleanup or Flake)](#other-cleanup-or-flake) @@ -476,6 +478,30 @@ filename | sha512 hash ## Changelog since v1.19.14 +## Important Security Information + +This release contains changes that address the following vulnerabilities: + +### CVE-2021-25741: Symlink Exchange Can Allow Host Filesystem Access + +A security issue was discovered in Kubernetes where a user may be able to +create a container with subpath volume mounts to access files & +directories outside of the volume, including on the host filesystem. +**Affected Versions**: + - kubelet v1.22.0 - v1.22.1 + - kubelet v1.21.0 - v1.21.4 + - kubelet v1.20.0 - v1.20.10 + - kubelet <= v1.19.14 +**Fixed Versions**: + - kubelet v1.22.2 + - kubelet v1.21.5 + - kubelet v1.20.11 + - kubelet v1.19.15 +This vulnerability was reported by Fabricio Voznika and Mark Wolters of Google. + + +**CVSS Rating:** High (8.8) [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) + ## Changes by Kind ### Bug or Regression