Lucene search

TigeraCVE-2020-13597

HistoryJun 03, 2020 - 5:15 p.m.

CVE-2020-13597

2020-06-0317:15:24

CWE-200

CWE-201

Tigera

web.nvd.nist.gov

cve-2020-13597

calico

calico enterprise

information disclosure

vulnerability

ipv6

network traffic

nvd

CVSS2

2.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:S/C:P/I:N/A:N

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

AI Score

3.8

Confidence

High

EPSS

0.001

Percentile

29.8%

JSON

Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod.

Affected configurations

Nvd

Node

projectcalicocalicoRange≤2.6.2enterprise

projectcalicocalicoRange≤3.8.8

projectcalicocalicoRange2.7.0–2.7.4enterprise

projectcalicocalicoRange2.8.0–2.8.2enterprise

projectcalicocalicoRange3.9.0–3.9.5

projectcalicocalicoRange3.10.0–3.10.3

projectcalicocalicoRange3.11.0–3.11.2

projectcalicocalicoRange3.12.0–3.12.1

projectcalicocalicoRange3.13.0–3.13.3

projectcalicocalicoMatch3.14.0

VendorProductVersionCPE
projectcalicocalico*cpe:2.3:a:projectcalico:calico:*:*:*:*:enterprise:*:*:*
projectcalicocalico*cpe:2.3:a:projectcalico:calico:*:*:*:*:*:*:*:*
projectcalicocalico3.14.0cpe:2.3:a:projectcalico:calico:3.14.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
projectcalico	calico	*	cpe:2.3:a:projectcalico:calico:::::enterprise:::*
projectcalico	calico	*	cpe:2.3:a:projectcalico:calico::::::::
projectcalico	calico	3.14.0	cpe:2.3:a:projectcalico:calico:3.14.0:::::::*

CNA Affected

[
  {
    "product": "Calico",
    "vendor": "Tigera Inc",
    "versions": [
      {
        "status": "affected",
        "version": "3.14.0"
      },
      {
        "lessThanOrEqual": "3.13.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.12.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.11.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.10.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.9.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "3.8.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "3.7.x"
      },
      {
        "status": "affected",
        "version": "3.6.x"
      },
      {
        "status": "affected",
        "version": "3.5.x"
      },
      {
        "status": "affected",
        "version": "3.4.x"
      },
      {
        "status": "affected",
        "version": "3.3.x"
      },
      {
        "status": "affected",
        "version": "3.2.x"
      },
      {
        "status": "affected",
        "version": "3.1.x"
      },
      {
        "status": "affected",
        "version": "3.0.x"
      },
      {
        "status": "affected",
        "version": "2.6.x"
      },
      {
        "status": "affected",
        "version": "2.5.x"
      },
      {
        "status": "affected",
        "version": "2.4.x"
      },
      {
        "status": "affected",
        "version": "2.3.x"
      },
      {
        "status": "affected",
        "version": "2.2.x"
      },
      {
        "status": "affected",
        "version": "2.1.x"
      },
      {
        "status": "affected",
        "version": "2.0.x"
      },
      {
        "status": "affected",
        "version": "1.6.x"
      },
      {
        "status": "affected",
        "version": "1.5.x"
      }
    ]
  },
  {
    "product": "Calico Enterprise",
    "vendor": "Tigera Inc",
    "versions": [
      {
        "lessThanOrEqual": "2.8.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "2.7.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "2.6.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "2.5.x"
      },
      {
        "status": "affected",
        "version": "2.4.x"
      },
      {
        "status": "affected",
        "version": "2.3.x"
      },
      {
        "status": "affected",
        "version": "2.2.x"
      },
      {
        "status": "affected",
        "version": "2.1.x"
      },
      {
        "status": "affected",
        "version": "2.0.x"
      }
    ]
  }
]