CVE-2020-10749

A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.

References

Affected packages

Git / github.com/containernetworking/plugins

Affected ranges

Type

GIT

Repo

https://github.com/containernetworking/plugins

Events

Introduced

Fixed

ad10b6fa91aacd720f1f9ab94341a97a82a24965

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.8.6"
        }
    ]
}

Affected versions

v0.*

v0.1.0

v0.2.0-rc0

v0.3.0

v0.3.0-rc0

v0.3.0-rc1

v0.3.0-rc2

v0.3.0-rc3

v0.6.0

v0.6.0-rc1

v0.6.0-rc2

v0.7.0

v0.7.0-rc1

v0.7.0-rc2

v0.7.1

v0.7.2

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.4

v0.8.5

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "4.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "32"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-10749.json"