PT-2020-12311 · Containernetworking+5 · Containernetworking-Plugins+5

Published 2020-06-03 · Updated 2024-08-20 · CVE-2020-10749

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions containernetworking/plugins versions prior to 0.8.6

Description A vulnerability was found that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.

Recommendations For versions prior to 0.8.6, update to version 0.8.6 or later to resolve the issue. As a temporary workaround, consider restricting the ability of containers to send IPv6 router advertisements to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-300

Related Identifiers

ALSA-2020:4694

ALSA-2020_4059

ALSA-2020_4694

CESA-2020_4694

CVE-2020-10749

ELSA-2020-4694

ELSA-2020-5725

ELSA-2020-5726

ELSA-2020-5727

GHSA-FX6X-H9G4-56F8

GO-2023-1915

OPENSUSE-SU-2020:1049-1

OPENSUSE-SU-2020:1050-1

OPENSUSE-SU-2020_1049-1

OPENSUSE-SU-2020_1050-1

OPENSUSE-SU-2024:10689-1

RHSA-2020:2403

RHSA-2020:2443

RHSA-2020:2592

RHSA-2020:2684

RHSA-2020:4694

RHSA-2020_4694

RLSA-2020:4694

RLSA-2020_4694

SUSE-SU-2020:1957-1

SUSE-SU-2020_1957-1

SUSE-SU-2022:4151-1

SUSE-SU-2022_4151-1

Affected Products

Almalinux

Centos

Red Hat

Rocky Linux

Suse

Containernetworking-Plugins

References · 84

• 🔥 https://github.com/knqyf263/CVE-2020-10749 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2022:4151-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2020:4694 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DV3HCDZYUTPPVDUMTZXDKK6IUO3JMGJC · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1050-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10749 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/DV3HCDZYUTPPVDUMTZXDKK6IUO3JMGJC · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-10749 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-10749 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00063.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2020:4694 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00065.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10749 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1915 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-10749 · Vendor Advisory