PT-2020-12547 · Weave · Weave Net

Morancj · Published 2020-06-03 · Updated 2024-08-21 · CVE-2020-11091

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Weave Net versions prior to 2.6.3

Description An attacker able to run a process as root in a container can respond to DNS requests from the host and insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host, it may be unconfigured or configured on some interfaces. The combination of IPv6 forwarding being disabled and the host accepting router advertisements means that the host can be reconfigured using rogue router advertisements. This allows an attacker to redirect part or all of the IPv6 traffic of the host to the attacker-controlled container. Even without initial IPv6 traffic, if the DNS returns both A and AAAA records, many HTTP libraries will try to connect via IPv6 first, giving the attacker an opportunity to respond.

Recommendations For Weave Net versions prior to 2.6.3, users should not run containers with CAP NET RAW capability as a workaround. Update to Weave Net version 2.6.3, which disables the accept ra option on the veth devices that it creates, to resolve the issue.

Fix

Weakness Enumeration

CWE-350

Related Identifiers

CVE-2020-11091

GHSA-59QG-GRP7-5R73

GO-2022-0794

Affected Products

Weave Net

References · 7

• https://github.com/weaveworks/weave/commit/15f21f1899060f7716c70a8555a084e836f39a60 · Patch
• https://osv.dev/vulnerability/GHSA-59qg-grp7-5r73 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0794 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11091 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11091 · Vendor Advisory
• https://github.com/weaveworks/weave/security/advisories/GHSA-59qg-grp7-5r73 · Note
• https://t.me/cvenotify/4175 · Telegram Post