From d5e5e73dcecb8a386583e0b43da37b014193fd49 Mon Sep 17 00:00:00 2001 From: ialidzhikov Date: Thu, 7 Oct 2021 11:09:12 +0300 Subject: [PATCH] Add CVE 2021-25741 info to 1.22 Release Notes Signed-off-by: ialidzhikov --- CHANGELOG/CHANGELOG-1.22.md | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/CHANGELOG/CHANGELOG-1.22.md b/CHANGELOG/CHANGELOG-1.22.md index 4543cb9bfce..f1f98d2a504 100644 --- a/CHANGELOG/CHANGELOG-1.22.md +++ b/CHANGELOG/CHANGELOG-1.22.md @@ -7,6 +7,8 @@ - [Server Binaries](#server-binaries) - [Node Binaries](#node-binaries) - [Changelog since v1.22.1](#changelog-since-v1221) + - [Important Security Information](#important-security-information) + - [CVE-2021-25741: Symlink Exchange Can Allow Host Filesystem Access](#cve-2021-25741-symlink-exchange-can-allow-host-filesystem-access) - [Changes by Kind](#changes-by-kind) - [Feature](#feature) - [Bug or Regression](#bug-or-regression) @@ -246,6 +248,32 @@ filename | sha512 hash ## Changelog since v1.22.1 +## Important Security Information + +This release contains changes that address the following vulnerabilities: + +### CVE-2021-25741: Symlink Exchange Can Allow Host Filesystem Access + +A security issue was discovered in Kubernetes where a user may be able to +create a container with subpath volume mounts to access files & +directories outside of the volume, including on the host filesystem. + +**Affected Versions**: + - kubelet v1.22.0 - v1.22.1 + - kubelet v1.21.0 - v1.21.4 + - kubelet v1.20.0 - v1.20.10 + - kubelet <= v1.19.14 + +**Fixed Versions**: + - kubelet v1.22.2 + - kubelet v1.21.5 + - kubelet v1.20.11 + - kubelet v1.19.15 + +This vulnerability was reported by Fabricio Voznika and Mark Wolters of Google. + +**CVSS Rating:** High (8.8) [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) + ## Changes by Kind ### Feature