CVE-2020-10749

Aliases:GHSA-fx6x-h9g4-56f8GO-2023-1915
Advisory lineage Upstream: 0 Downstream: 12
Modified
Published: 03 Jun 2020, 13:45
Last modified:04 Aug 2024, 11:14

Vulnerability Summary

Overall Risk (default)
low
24/100
CVSS Score
6 MEDIUM
v3.1 (cve.org)
EPSS Score
1.84% LOW
2% probability -3.34%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

03 Jun 2020, 13:45
Published
Vulnerability first disclosed
04 Aug 2024, 11:14
Last Modified
Vulnerability information updated

Description

A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
  • v2.0•MEDIUM•Score: 6AV:N/AC:M/Au:S/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 1.84%• Percentile: 83%

Techniques & Countermeasures

  • CWE-300•Channel Accessible by Non-Endpoint

    The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

Affected Systems

  • fedoraproject•fedora

    32

  • github.com/containernetworking•plugins

    < 0.8.6

  • linuxfoundation•cni_network_plugins

    < 0.8.6

  • red hat•containernetworking/plugins

    all containernetworking/plugins versions before version 0.8.6

  • redhat•enterprise_linux

    7.0 | 8.0

  • redhat•openshift_container_platform

    4.0

References (11)