CVE-2020-10749 — Channel Accessible by Non-Endpoint in Containernetworking Plugins
Severity
6.0MEDIUMNVD
EPSS
5.2%
top 10.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 3
Latest updateAug 20
Description
A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:LExploitability: 1.8 | Impact: 3.7
Affected Packages3 packages
▶CVEListV5red_hat/containernetworking_pluginsall containernetworking/plugins versions before version 0.8.6
Also affects: Openshift Container Platform 4.0, Fedora 32, Enterprise Linux 7.0, 8.0
🔴Vulnerability Details
5OSV▶
containernetworking/plugins vulnerable to MitM attacks in github.com/containernetworking/plugins↗2024-08-20
OSV▶
CVE-2020-10749: A vulnerability was found in all versions of containernetworking/plugins before version 0↗2020-06-03
CVEList▶
CVE-2020-10749: A vulnerability was found in all versions of containernetworking/plugins before version 0↗2020-06-03
📋Vendor Advisories
2💬Community
3Bugzilla▶
CVE-2020-10749 containernetworking-plugins: containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters [fedora-all]↗2020-06-01
Bugzilla▶
CVE-2020-10749 golang-github-containernetworking-plugins: containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters [fedora-all]↗2020-06-01
Bugzilla▶
CVE-2020-10749 containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters↗2020-05-08