Skip to content
Fencer Vulns
medium 6.0

CVE-2020-10749 json

containernetworking/plugins vulnerable to MitM attacks

published 2020-06-03 6 y ago modified 2026-09-10 1 mo ago also GHSA-fx6x-h9g4-56f8 , GO-2023-1915 , EUVD-2022-3850

cvss
6.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.

Patch / fix

  • go github.com/containernetworking/plugins 0.8.6
  • linuxfoundation cni_network_plugins 0.8.6
  • golang-github-containernetworking-plugins Debian 14, Debian 13, Debian 12 0.8.6-1

debian advisories DEBIAN-CVE-2020-10749

  • crit RHEL 8 3.14-2.module+el8.3.0+8221+97165c3f
  • criu RHEL 8 3.14-2.module+el8.3.0+8221+97165c3f
  • crun RHEL 8 0.14.1-2.module+el8.3.0+8221+97165c3f
  • runc RHEL 8 1.0.0-68.rc92.module+el8.3.0+8221+97165c3f
  • udica RHEL 8 0.2.2-1.module+el8.3.0+8221+97165c3f
  • conmon RHEL 8 2:2.0.20-2.module+el8.3.0+8221+97165c3f
  • podman RHEL 8 2.0.5-5.module+el8.3.0+8221+97165c3f
  • skopeo RHEL 8 1:1.1.1-3.module+el8.3.0+8221+97165c3f

red hat advisories RHSA-2020:4694RHSA-2020:2592RHSA-2020:2684RHSA-2020:2403RHSA-2020:2443

  • cni-plugins SLE Module for Public Cloud 15 0.8.6-150000.1.7.1
  • cni-plugins SLE Module for Public Cloud 15 SP1, SLE Module for Containers 15 SP2, SLE Module for Containers 15 SP1 0.8.6-3.6.1

suse advisories SUSE-SU-2022:4151-1SUSE-SU-2020:1957-1

  • cni-plugins openSUSE Tumbleweed 0.9.1-1.3
  • cni-plugins openSUSE Leap 15.2 0.8.6-lp152.2.4.1
  • cni-plugins openSUSE Leap 15.1 0.8.6-lp151.2.6.1

opensuse advisories openSUSE-SU-2024:10689-1openSUSE-SU-2020:1050-1openSUSE-SU-2020:1049-1

  • libslirp AlmaLinux 8 4.3.1-1.module_el8.6.0+2876+9ed4eae2
  • python-podman-api AlmaLinux 8 1.2.0-0.2.gitd0a45fe.module_el8.5.0+2635+e4386a39
  • python-podman-api AlmaLinux 8 1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455

almalinux advisories ALSA-2020:4694

  • toolbox Rocky Linux 8 0.0.8-1.module+el8.4.0+556+40122d08
  • libslirp Rocky Linux 8 4.3.1-1.module+el8.7.0+1076+9b1c11c1
  • libslirp Rocky Linux 8 4.3.1-1.module+el8.4.0+556+40122d08
  • libslirp Rocky Linux 8 4.3.1-1.module+el8.5.0+709+440d5e7e
  • libslirp Rocky Linux 8 4.3.1-1.module+el8.6.0+783+10209741
  • python-podman-api Rocky Linux 8 1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f49861
  • python-podman-api Rocky Linux 8 1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2
  • python-podman-api Rocky Linux 8 1.2.0-0.2.gitd0a45fe.module+el8.5.0+708+6758137d

rocky linux advisories RLSA-2020:4694

  • k3s Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 1.18.3.1-r0

alpine advisories ALPINE-CVE-2020-10749

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-10749 updated cvss 6.0

containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters

  • Red Hat Enterprise Linux 8 containernetworking-plugins
    affected: workaround, no fix planned “Prevent untrusted, non-privileged containers from running with CAP_NET_RAW.”
  • Red Hat OpenShift Container Platform 4 openshift4/sriov-cni-rhel9, openshift4/ose-container-networking-plugins-rhel8
    affected: workaround, no fix available, no fix planned “Prevent untrusted, non-privileged containers from running with CAP_NET_RAW.”
  • Red Hat OpenShift Virtualization 1 multus-cni, ovs-cni-plugin
    affected: workaround, no fix planned “Prevent untrusted, non-privileged containers from running with CAP_NET_RAW.”
  • Red Hat OpenShift Virtualization 2 ovs-cni-plugin
    affected: workaround, no fix available “Prevent untrusted, non-privileged containers from running with CAP_NET_RAW.”
  • Red Hat CNV 2.4 for RHEL 8 container-native-virtualization/kubevirt-cpu-node-labeller v2.4.0-19, container-native-virtualization/vm-import-controller-rhel8 v2.4.0-21, container-native-virtualization/kubevirt-kvm-info-nfd-plugin v2.4.0-18, container-native-virtualization/kubevirt-cpu-model-nfd-plugin v2.4.0-17
    fixed: vendor fix “Prevent untrusted, non-privileged containers from running with CAP_NET_RAW.” RHSA-2020:3194
  • Red Hat Enterprise Linux 7 Extras containernetworking-plugins 0.8.3-3.el7_8
    fixed: vendor fix “Prevent untrusted, non-privileged containers from running with CAP_NET_RAW.” RHSA-2020:2684
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.14-2.module+el8.3.0+8221+97165c3f, criu 3.14-2.module+el8.3.0+8221+97165c3f, crun 0.14.1-2.module+el8.3.0+8221+97165c3f, udica 0.2.2-1.module+el8.3.0+8221+97165c3f, podman 2.0.5-5.module+el8.3.0+8221+97165c3f, skopeo 1.1.1-3.module+el8.3.0+8221+97165c3f, +20 more
    fixed: vendor fix “Prevent untrusted, non-privileged containers from running with CAP_NET_RAW.” RHSA-2020:4694
  • Red Hat OpenShift Container Platform 4.2 containernetworking-plugins 0.8.6-1.rhaos4.2.el7, containernetworking-plugins 0.8.6-1.rhaos4.2.el8
    fixed: vendor fix “Prevent untrusted, non-privileged containers from running with CAP_NET_RAW.” RHSA-2020:2592
show 5 more
  • Red Hat OpenShift Container Platform 4.3 containernetworking-plugins 0.8.6-1.rhaos4.3.el7, containernetworking-plugins 0.8.6-1.rhaos4.3.el8
    fixed: vendor fix “Prevent untrusted, non-privileged containers from running with CAP_NET_RAW.” RHSA-2020:2443
  • Red Hat OpenShift Container Platform 4.4 containernetworking-plugins 0.8.6-1.rhaos4.4.el7, containernetworking-plugins 0.8.6-1.rhaos4.4.el8
    fixed: vendor fix “Prevent untrusted, non-privileged containers from running with CAP_NET_RAW.” RHSA-2020:2403
  • Red Hat OpenShift Container Platform 4.5 openshift4/ose-cli v4.5.0-202007012112.p0, openshift4/ose-pod v4.5.0-202007012112.p0, openshift4/ose-etcd v4.5.0-202007012112.p0, openshift4/ose-tests v4.5.0-202007100518.p0, openshift4/ose-coredns v4.5.0-202007012112.p0, openshift4/ose-grafana v4.5.0-202007012112.p0, +72 more
    fixed: vendor fix “Prevent untrusted, non-privileged containers from running with CAP_NET_RAW.” RHBA-2020:2409
  • Red Hat OpenShift Container Platform 4.7 openshift4/ose-sdn-rhel8 v4.7.0-202102130115.p0
    fixed: vendor fix “Prevent untrusted, non-privileged containers from running with CAP_NET_RAW.” RHSA-2020:5633
  • Red Hat Enterprise Linux 8 containernetworking-plugins Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more Red Hat OpenShift Container Platform 4.5 openshift4/ose-console v4.5.0-202007012112.p0, openshift4/ose-hyperkube v4.5.0-202007100518.p0, openshift4/ose-cluster-capacity v4.5.0-202007012112.p0, openshift4/ose-oauth-server-rhel7 v4.5.0-202007012112.p0, openshift4/ose-cluster-logging-operator v4.5.0-202007012112.p0, openshift4/ose-cluster-machine-approver v4.5.0-202007012112.p0 Red Hat OpenShift Container Platform 4.7 openshift4/ose-cli v4.7.0-202102130115.p0, openshift4/ose-pod v4.7.0-202102130115.p0, openshift4/ose-etcd v4.7.0-202102130115.p0, openshift4/ose-tests v4.7.0-202102181036.p0, openshift4/ose-console v4.7.0-202102130115.p0, openshift4/ose-coredns v4.7.0-202102130115.p0, +129 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.09% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.0 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
NVD 3.1 6.0 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
NVD 2.0 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P
GitHub 3.1 6.0 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
go github.com/containernetworking/plugins
<0.8.6
0.8.6

Affected products

  • Red Hat containernetworking/plugins

Classification

Weakness
  • CWE-300 Channel Accessible by Non-Endpoint

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.