CVE-2019-9946Always-Incorrect Control Flow Implementation in Portmap

Severity
7.5HIGHNVD
EPSS
0.5%
top 32.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedApr 2
Latest updateJul 31

Description

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. Th

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

debiandebian/golang-github-containernetworking-plugins< kubernetes 1.17.4-1 (bookworm)
NVDcncf/portmap< 0.7.5
debiandebian/kubernetes< kubernetes 1.17.4-1 (bookworm)
NVDkubernetes/kubernetes1.12.01.12.7+4
Debiankubernetes/kubernetes< 1.17.4-1+3

Patches

🔴Vulnerability Details

2
GHSA
GHSA-6g96-g4m6-hw69: Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 02022-05-13
OSV
CVE-2019-9946: Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 02019-04-02

📋Vendor Advisories

2
Red Hat
kubernetes: Incorrect rule injection in CNI portmap plugin2019-03-28
Debian
CVE-2019-9946: golang-github-containernetworking-plugins - Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0....2019

📄Research Papers

1
arXiv
Microservice Vulnerability Analysis: A Literature Review with Empirical Insights2024-07-31

💬Community

8
HackerOne
IPv4 only clusters susceptible to MitM attacks via IPv6 rogue router advertisements2021-11-07
Bugzilla
CVE-2019-9946 containernetworking-plugins: kubernetes: Incorrect rule injection in CNI portmap plugin [fedora-all]2019-05-31
Bugzilla
CVE-2019-9946 containernetworking-cni: kubernetes: Incorrect rule injection in CNI portmap plugin [epel-7]2019-05-30
Bugzilla
CVE-2019-9946 kubernetes: Incorrect rule injection in CNI portmap plugin [fedora-all]2019-03-29
Bugzilla
CVE-2019-9946 kubernetes:openshift-3.10/origin: kubernetes: Incorrect rule injection in CNI portmap plugin [fedora-29]2019-03-29
CVE-2019-9946 — Cncf Portmap vulnerability | cvebase