MEDIUM6.0
GHSA-fx6x-h9g4-56f8
containernetworking/plugins vulnerable to MitM attacks
Quick fix
GHSA-fx6x-h9g4-56f8 — github.com/containernetworking/plugins: upgrade to the fixed version with the command below.
go get github.com/containernetworking/plugins@v0.8.6Details
A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/containernetworking/plugins
Introduced in:
0Fixed in: 0.8.6Fix
go get github.com/containernetworking/plugins@v0.8.6References
- https://nvd.nist.gov/vuln/detail/CVE-2020-10749[ADVISORY]
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10749[WEB]
- https://github.com/containernetworking/plugins[PACKAGE]
- https://github.com/containernetworking/plugins/releases/tag/v0.8.6[WEB]
- https://groups.google.com/forum/#!topic/kubernetes-security-announce/BMb_6ICCfp8[WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DV3HCDZYUTPPVDUMTZXDKK6IUO3JMGJC[WEB]
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00063.html[WEB]
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00065.html[WEB]