CVE-2021-3499: 
Red Hat Enterprise Linux CoreOS (RHCOS) vulnerability analysis and mitigation

CVE-2021-3499 is a vulnerability discovered in OVN Kubernetes versions up to and including 0.3.0, where the Egress Firewall functionality fails to reliably apply firewall rules when multiple DNS rules are present. The vulnerability was reported on April 13, 2021, and affects the OVN-Kubernetes Container Network Interface (CNI) network provider (Bugzilla Report).

The vulnerability occurs when EgressFirewalls are configured with multiple DNS rules (approximately 5 or more dnsNames), which can lead to a deadlock condition. This issue has been assigned a CVSS v3.1 base score of 5.6 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating network accessibility with high attack complexity and no privileges required (NVD).

The vulnerability could potentially lead to a loss of confidentiality, integrity, or availability of services. When the deadlock occurs, the effective firewall rules may differ from the expected configuration, potentially exposing services to unauthorized access or restrictions (Bugzilla Report).

The vulnerability requires specific conditions to be exploited, particularly the presence of multiple DNS rules in the EgressFirewall configuration. It's important to note that this issue only affects the OVN-Kubernetes CNI network provider and does not impact OpenShift SDN, which is the default Container Network Interface provider in OpenShift Container Platform 4 (Bugzilla Report).

The vulnerability was addressed in OpenShift Container Platform version 4.7.11 with the container ose-ovn-kubernetes-container-v4.7.0-202105071917.p0. The fix was implemented through an upstream pull request to the ovn-kubernetes repository (Bugzilla Report).