CVE-2020-10749
Aliases:GHSA-fx6x-h9g4-56f8GO-2023-1915RHSA-2020:2403RHSA-2020:2443RHSA-2020:2592RHSA-2020:2684DEBIAN-CVE-2020-10749CGA-22v6-f6h2-6wq9CGA-36wx-75fc-f862CGA-37rf-8cr9-pcc8CGA-3g6g-5v9c-93q2CGA-43q8-26rh-vp26CGA-4cww-9c3j-c4h3CGA-4g58-jcpj-p5j8CGA-5285-h78f-3wwcCGA-577m-fw8g-4792CGA-5f83-2cw5-j7fgCGA-5rjf-cpqv-x4g8CGA-5xgf-9q9f-j2vgCGA-635q-38wp-844hCGA-6995-h3x3-8gh5CGA-6gc2-682v-8cp9CGA-6m9c-49mg-mmf4CGA-6vwc-248c-fqhxCGA-79m5-c4w2-53pvCGA-7jhh-j3vv-fh74CGA-7rqp-f83v-cq47CGA-869q-38h5-r32mCGA-879w-3jmv-gxxhCGA-87fh-6w84-gcxpCGA-8fx7-r9rv-ggffCGA-8vcj-4pp6-r3wqCGA-9gw6-q3xh-79v4CGA-9whj-p6hx-wwp5CGA-c3mm-vpvh-c48rCGA-crg2-6wx4-ffr7CGA-ffcq-jj3j-w7gpCGA-fm85-74c7-fh92CGA-g3pr-vghg-v3v5CGA-g76f-c3xc-p3f7CGA-gj6h-6r7h-h7qcCGA-gvc4-xqxf-9459CGA-gvvv-6rm6-v3x3CGA-gwhw-cxw3-44wjCGA-h52m-2c42-m8q8CGA-hf9f-9qh3-225mCGA-hpwq-q853-j2q2CGA-hw4v-37vh-67wfCGA-hwj6-mm6m-v58gCGA-j42q-f8j3-x4fwCGA-j9w6-qh5c-xjrcCGA-jg44-w6hv-9gc5CGA-jgv9-4m7x-2c3fCGA-jq9x-wpwq-2gfxCGA-jvv4-c875-4469CGA-m2wx-c38j-mqcpCGA-m2x6-gh9q-x36wCGA-mqxh-qmmm-ppqpCGA-mr94-2pcf-x95fCGA-p4f6-mmwm-mmqqCGA-p5w6-8266-gxxvCGA-pg4x-9p6m-cm99CGA-ph87-25vm-w2q3CGA-phrh-qjpj-gqvhCGA-q5p5-3894-7j6cCGA-qgvx-w8g5-fw78CGA-qxqc-8f6w-ghwvCGA-r4p8-7ggp-xqg5CGA-rhr3-f8p8-w437CGA-rr2x-r9fq-63h2CGA-rvjc-63w7-r63mCGA-v6r9-phhg-23g8CGA-v7vm-pwf4-phc9CGA-vv9w-cxvw-cc84CGA-wf2x-3g48-4g47CGA-x2hh-h9xf-wxqfCGA-x52f-f8w9-4fh9CGA-xg9v-82j7-gpf9CGA-xgwc-c783-m8wc
Advisory lineage Upstream: 0 Downstream: 12
Modified
Published: 03 Jun 2020, 13:45
Last modified:04 Aug 2024, 11:14
Vulnerability Summary
Overall Risk (default)
low
24/100 CVSS Score
6 MEDIUM
v3.1 (cve.org)
EPSS Score
2.43% LOW
2% probability -2.76%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
03 Jun 2020, 13:45
Published
Vulnerability first disclosed
04 Aug 2024, 11:14
Last Modified
Vulnerability information updated
Description
A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.
CVSS Metrics
- v3.1•MEDIUM•Score: 6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
- v2.0•MEDIUM•Score: 6AV:N/AC:M/Au:S/C:P/I:P/A:P
EPSS Trends
Current EPSS score: 2.43%• Percentile: 83%
Techniques & Countermeasures
- CWE-300•Channel Accessible by Non-Endpoint
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
Affected Systems
- chainguard•cni-plugins-fips
< 0
- chainguard•cni-plugins-fips-bandwidth
< 0
- chainguard•cni-plugins-fips-bandwidth-compat
< 0
- chainguard•cni-plugins-fips-bridge
< 0
- chainguard•cni-plugins-fips-bridge-compat
< 0
- chainguard•cni-plugins-fips-dhcp
< 0
- chainguard•cni-plugins-fips-dhcp-compat
< 0
- chainguard•cni-plugins-fips-dummy
< 0
- chainguard•cni-plugins-fips-dummy-compat
< 0
- chainguard•cni-plugins-fips-firewall
< 0
- chainguard•cni-plugins-fips-firewall-compat
< 0
- chainguard•cni-plugins-fips-host-device
< 0
- chainguard•cni-plugins-fips-host-device-compat
< 0
- chainguard•cni-plugins-fips-host-local
< 0
- chainguard•cni-plugins-fips-host-local-compat
< 0
- chainguard•cni-plugins-fips-ipam
< 0
- chainguard•cni-plugins-fips-ipvlan
< 0
- chainguard•cni-plugins-fips-ipvlan-compat
< 0
- chainguard•cni-plugins-fips-loopback
< 0
- chainguard•cni-plugins-fips-loopback-compat
< 0
- chainguard•cni-plugins-fips-macvlan
< 0
- chainguard•cni-plugins-fips-macvlan-compat
< 0
- chainguard•cni-plugins-fips-main
< 0
- chainguard•cni-plugins-fips-meta
< 0
- chainguard•cni-plugins-fips-portmap
< 0
- chainguard•cni-plugins-fips-portmap-compat
< 0
- chainguard•cni-plugins-fips-ptp
< 0
- chainguard•cni-plugins-fips-ptp-compat
< 0
- chainguard•cni-plugins-fips-sbr
< 0
- chainguard•cni-plugins-fips-sbr-compat
< 0
- chainguard•cni-plugins-fips-static
< 0
- chainguard•cni-plugins-fips-static-compat
< 0
- chainguard•cni-plugins-fips-tuning
< 0
- chainguard•cni-plugins-fips-tuning-compat
< 0
- chainguard•cni-plugins-fips-vlan
< 0
- chainguard•cni-plugins-fips-vlan-compat
< 0
- debian•golang-github-containernetworking-plugins
< 0.8.6-1 | < 0.8.6-1 | < 0.8.6-1 | < 0.8.6-1
- fedoraproject•fedora
32
- github.com/containernetworking•plugins
< 0.8.6
- linuxfoundation•cni_network_plugins
< 0.8.6
- red hat•containernetworking/plugins
all containernetworking/plugins versions before version 0.8.6
- redhat•enterprise_linux
7.0 | 8.0
- redhat•openshift_container_platform
4.0
- redhat•containernetworking-plugins
< 0:0.8.6-1.rhaos4.4.el7 | < 0:0.8.6-1.rhaos4.4.el8 | < 0:0.8.6-1.rhaos4.3.el7 | < 0:0.8.6-1.rhaos4.3.el8 | < 0:0.8.6-1.rhaos4.2.el7 | < 0:0.8.6-1.rhaos4.2.el8 | < 0:0.8.3-3.el7_8
- redhat•containernetworking-plugins-debuginfo
< 0:0.8.6-1.rhaos4.4.el7 | < 0:0.8.6-1.rhaos4.4.el8 | < 0:0.8.6-1.rhaos4.3.el7 | < 0:0.8.6-1.rhaos4.3.el8 | < 0:0.8.6-1.rhaos4.2.el7 | < 0:0.8.6-1.rhaos4.2.el8 | < 0:0.8.3-3.el7_8
- redhat•containernetworking-plugins-debugsource
< 0:0.8.6-1.rhaos4.4.el8 | < 0:0.8.6-1.rhaos4.3.el8 | < 0:0.8.6-1.rhaos4.2.el8
References (24)
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10749
- https://groups.google.com/forum/#%21topic/kubernetes-security-announce/BMb_6ICCfp8
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00063.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00065.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DV3HCDZYUTPPVDUMTZXDKK6IUO3JMGJC/
- https://nvd.nist.gov/vuln/detail/CVE-2020-10749
- https://github.com/containernetworking/plugins
- https://github.com/containernetworking/plugins/releases/tag/v0.8.6
- https://groups.google.com/forum/#!topic/kubernetes-security-announce/BMb_6ICCfp8
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DV3HCDZYUTPPVDUMTZXDKK6IUO3JMGJC
- https://github.com/advisories/GHSA-fx6x-h9g4-56f8
- https://access.redhat.com/errata/RHSA-2020:2403
- https://access.redhat.com/security/updates/classification/#moderate
- https://bugzilla.redhat.com/show_bug.cgi?id=1833220
- https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2403.json
- https://access.redhat.com/security/cve/CVE-2020-10749
- https://www.cve.org/CVERecord?id=CVE-2020-10749
- https://access.redhat.com/errata/RHSA-2020:2443
- https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2443.json
- https://access.redhat.com/errata/RHSA-2020:2592
- https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2592.json
- https://access.redhat.com/errata/RHSA-2020:2684
- https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2684.json
- https://security-tracker.debian.org/tracker/CVE-2020-10749