A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
| Link | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10749 | issue tracking third party advisory |
| https://groups.google.com/forum/#%21topic/kubernetes-security-announce/BMb_6ICCfp8 | |
| http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00063.html | broken link third party advisory vendor advisory |
| http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00065.html | broken link third party advisory vendor advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DV3HCDZYUTPPVDUMTZXDKK6IUO3JMGJC/ | vendor advisory |