Reconciling the Past: Correcting Records for Unfixed Kubernetes CVEs

AI summary

The Kubernetes Security Response Committee is updating several historical CVE records to accurately reflect that they remain unfixed due to inherent architectural design trade-offs. By removing incorrect 'fixed version' fields, the project aims to improve the fidelity of vulnerability scanners and ensure administrators correctly identify and mitigate these risks. These changes formalize the status of vulnerabilities like CVE-2020-8561 and CVE-2021-25740 as permanent architectural considerations.

Key points

• Vulnerability records should accurately represent 'unfixed' status for architectural trade-offs to avoid scanner false negatives.
• Correcting CVE metadata improves the reliability of automated security tooling and risk assessment pipelines.
• Certain Kubernetes security issues are intentional design behaviors that require administrative mitigation rather than code patches.
• Standardized versioning and reporting in security feeds are critical for maintaining transparency in large open-source projects.