openwall.com
http://www.openwall.com/lists/oss-security/2025/03/20/2 CVE-2024-7598
LOW
Network restriction bypass via race condition during namespace termination
Record summary
CVE-2024-7598 has a selected CVSS score of 3.1 (low).
Description
A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 20, 2025 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
kube-apiserverBrowse Kubernetes / kube-apiserverDefault status: unaffected | CVE List | 1.3.0 | affected |
| Before 1.3.0 | unaffected | ||
k8s.io/kubernetes/cmd/kube-apiserverBrowse Go / k8s.io/kubernetes/cmd/kube-apiserver | GitHub Advisory | 1.3.0 to ≤ 1.32.3 | affected |
References
5github.com
https://github.com/kubernetes/kubernetes github.comissue trackingVendor advisory
https://github.com/kubernetes/kubernetes/issues/126587 groups.google.commailing list
https://groups.google.com/g/kubernetes-security-announce/c/67D7UFqiPRc nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-7598