A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4694 advisory.

  - A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows     malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious     container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other     containers, to redirect traffic to the malicious container. (CVE-2020-10749)

  - An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before 4.3.1. (CVE-2020-10756)

  - The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the     UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker     could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an     infinite loop if the String function on the Decoder is called, or the Decoder is passed to     golang.org/x/text/transform.String. (CVE-2020-14040)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5727 advisory.

  - A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows     malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious     container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other     containers, to redirect traffic to the malicious container. (CVE-2020-10749)

  - The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9,     v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain     authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the     master's host network (such as link-local or loopback services). (CVE-2020-8555)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5725 advisory.

  - A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows     malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious     container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other     containers, to redirect traffic to the malicious container. (CVE-2020-10749)

  - The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9,     v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain     authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the     master's host network (such as link-local or loopback services). (CVE-2020-8555)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5726 advisory.

  - A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows     malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious     container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other     containers, to redirect traffic to the malicious container. (CVE-2020-10749)

  - The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This     vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and     return its result to the user/client. This can be used to gain information about the network that Grafana     is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.
    (CVE-2020-13379)

  - The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9,     v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain     authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the     master's host network (such as link-local or loopback services). (CVE-2020-8555)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4694 advisory.

  - A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows     malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious     container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other     containers, to redirect traffic to the malicious container. (CVE-2020-10749)

  - The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the     UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker     could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an     infinite loop if the String function on the Decoder is called, or the Decoder is passed to     golang.org/x/text/transform.String. (CVE-2020-14040)

  - An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before 4.3.1. (CVE-2020-10756)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2403 advisory.

  - containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters     (CVE-2020-10749)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4151-1 advisory.

  - A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows     malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious     container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other     containers, to redirect traffic to the malicious container. (CVE-2020-10749)

  - An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1.
    When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use     special elements such as ../ separators to reference binaries elsewhere on the system. This flaw allows     an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The     highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
    (CVE-2021-20206)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4694 advisory.

  - containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters     (CVE-2020-10749)

  - QEMU: slirp: networking out-of-bounds read information disclosure vulnerability (CVE-2020-10756)

  - golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash     (CVE-2020-14040)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-ccb8a9c403 advisory.

  - A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows     malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious     container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other     containers, to redirect traffic to the malicious container. (CVE-2020-10749)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4694 advisory.

  - containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters     (CVE-2020-10749)

  - QEMU: slirp: networking out-of-bounds read information disclosure vulnerability (CVE-2020-10756)

  - golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash     (CVE-2020-14040)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for cni-plugins fixes the following issues :

cni-plugins updated to version 0.8.6&#9; 

  - CVE-2020-10749: Fixed a potential Man-in-the-Middle     attacks in IPv4 clusters by spoofing IPv6 router     advertisements (bsc#1172410).

Release notes:
https://github.com/containernetworking/plugins/releases/tag/v0.8.6

This update for cni-plugins fixes the following issues :

cni-plugins updated to version 0.8.6&#9; 

  - CVE-2020-10749: Fixed a potential Man-in-the-Middle     attacks in IPv4 clusters by spoofing IPv6 router     advertisements (bsc#1172410).

Release notes:
https://github.com/containernetworking/plugins/releases/tag/v0.8.6

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for cni-plugins fixes the following issues :

cni-plugins updated to version 0.8.6

CVE-2020-10749: Fixed a potential Man-in-the-Middle attacks in IPv4 clusters by spoofing IPv6 router advertisements (bsc#1172410).

Release notes:
https://github.com/containernetworking/plugins/releases/tag/v0.8.6

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2592 advisory.

  - containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters     (CVE-2020-10749)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2684 advisory.

  - containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters     (CVE-2020-10749)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2443 advisory.

  - containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters     (CVE-2020-10749)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
185064	Rocky Linux 8 : container-tools:rhel8 (RLSA-2020:4694)	Nessus	Rocky Linux Local Security Checks	medium
180996	Oracle Linux 7 : kubernetes-cni-plugins / kubernetes-cni / kubernetes / olcne (ELSA-2020-5727)	Nessus	Oracle Linux Local Security Checks	medium
180943	Oracle Linux 7 : kubernetes / kubeadm-ha-setup / kubernetes-cni / kubernetes-cni-plugins (ELSA-2020-5725)	Nessus	Oracle Linux Local Security Checks	medium
180932	Oracle Linux 7 : grafana / kubernetes-cni / kubernetes-cni-plugins / kubernetes / kubernetes / olcne (ELSA-2020-5726)	Nessus	Oracle Linux Local Security Checks	high
180889	Oracle Linux 8 : container-tools:ol8 (ELSA-2020-4694)	Nessus	Oracle Linux Local Security Checks	medium
170355	RHEL 7 / 8 : OpenShift Container Platform 4.4.8 containernetworking-plugins (RHSA-2020:2403)	Nessus	Red Hat Local Security Checks	medium
168081	SUSE SLES15 Security Update : cni-plugins (SUSE-SU-2022:4151-1)	Nessus	SuSE Local Security Checks	high
145914	CentOS 8 : container-tools:rhel8 (CESA-2020:4694)	Nessus	CentOS Local Security Checks	medium
144842	Fedora 32 : golang-github-containernetworking-plugins (2021-ccb8a9c403)	Nessus	Fedora Local Security Checks	medium
142451	RHEL 8 : container-tools:rhel8 (RHSA-2020:4694)	Nessus	Red Hat Local Security Checks	medium
138982	openSUSE Security Update : cni-plugins (openSUSE-2020-1050)	Nessus	SuSE Local Security Checks	medium
138981	openSUSE Security Update : cni-plugins (openSUSE-2020-1049)	Nessus	SuSE Local Security Checks	medium
138791	SUSE SLES15 Security Update : cni-plugins (SUSE-SU-2020:1957-1)	Nessus	SuSE Local Security Checks	medium
138032	RHEL 7 / 8 : OpenShift Container Platform 4.2.36 containernetworking-plugins (RHSA-2020:2592)	Nessus	Red Hat Local Security Checks	medium
137752	RHEL 7 : containernetworking-plugins (RHSA-2020:2684)	Nessus	Red Hat Local Security Checks	medium
137561	RHEL 7 / 8 : OpenShift Container Platform 4.3.25 containernetworking-plugins (RHSA-2020:2443)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2020-10749

medium

Tenable Plugins

medium

medium

medium

high

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium