CVE-2020-13597 json
Calico nodes IPv6 traffic redirection from route advertisment
published 2020-06-03 6 y ago modified 2026-08-07 3 mo ago also EUVD-2022-1122 , GHSA-pf59-j7c2-rh6x
- cvss
- 6.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod.
Patch / fix
- go github.com/projectcalico/calico 3.8.9, 3.9.6, 3.10.4, 3.11.3, 3.12.2, 3.13.4, 3.14.1
- projectcalico calico 3.8.9, 3.9.6, 3.10.4, 3.11.3, 3.12.2, 3.13.4, 3.14.1
- tigera calico_os 3.8.9, 3.9.6, 3.10.4, 3.11.3, 3.12.2, 3.13.4, 3.14.1
- tigera calico_enterprise 2.6.3, 2.7.5, 2.8.3
Exploit prediction
0.90% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L |
| GitHub | 3.1 | 6.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L |
| NVD | 3.1 | 3.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N |
| NVD | 2.0 | 2.1 | AV:N/AC:H/Au:S/C:P/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/projectcalico/calico | >=3.14.0, <3.14.1 >=3.13.0, <3.13.4 >=3.12.0, <3.12.2 >=3.11.0, <3.11.3 >=3.10.0, <3.10.4 >=3.9.0, <3.9.6 <3.8.9 |
3.14.1 3.13.4 3.12.2 3.11.3 3.10.4 3.9.6 3.8.9 |
Affected products
- Tigera Inc Calico
- Tigera Inc Calico Enterprise
Classification
References
-
github.com
/containernetworking/plugins/pull/484
web
-
github.com
/containernetworking/plugins/commit/ad10b6fa91aacd720f1f9ab94341a97a82a24965
web
-
projectcalico.org
/security-bulletins/
vendor-advisory
- groups.google.com /forum/#%21topic/kubernetes-security-announce/BMb_6ICCfp8
-
github.com
/kubernetes/kubernetes/issues/91507
web, issue-tracking, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-13597
advisory
-
github.com
/projectcalico/calico
package
-
groups.google.com
/forum/#!topic/kubernetes-security-announce/BMb_6ICCfp8
web
-
projectcalico.org
/security-bulletins
web
Sources
- CVE List CVE-2020-13597
- GitHub Advisory GHSA-pf59-j7c2-rh6x
- NVD CVE-2020-13597
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Adds the additional tigera:calico_enterprise and tigera:calico_os CPEs used on newer CVEs to this historical one.