Search for packages
| purl | pkg:alpm/archlinux/kube-proxy@1.23.0-1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 1.4 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-4qqj-251q-ykek
Aliases: CVE-2021-25740 GHSA-vw47-mr44-3jf9 |
Confused Deputy in Kubernetes A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack. | There are no reported fixed by versions. |
|
VCID-vu3k-upyc-x7av
Aliases: CVE-2020-8562 GHSA-qh36-44jv-c8xj |
Potential proxy IP restriction bypass in Kubernetes As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. All versions of Kubernetes are impacted, and there is no fix in place. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T18:24:07.259059+00:00 | Arch Linux Importer | Affected by | VCID-vu3k-upyc-x7av | https://security.archlinux.org/AVG-1915 | 38.0.0 |
| 2026-04-01T18:24:07.240661+00:00 | Arch Linux Importer | Affected by | VCID-4qqj-251q-ykek | https://security.archlinux.org/AVG-1915 | 38.0.0 |