GHSA-fx6x-h9g4-56f8
containernetworking/plugins vulnerable to MitM attacks
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/containernetworking/plugins | < 0.8.6 | 0.8.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2020-10749
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10749
- https://github.com/containernetworking/plugins
- https://github.com/containernetworking/plugins/releases/tag/v0.8.6
- https://groups.google.com/forum/#!topic/kubernetes-security-announce/BMb_6ICCfp8
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DV3HCDZYUTPPVDUMTZXDKK6IUO3JMGJC
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00063.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00065.html