cnvd - cnvd-2021-31254

CNVD-2021-31254

Vulnerability from cnvd - Published: 2021-04-27

Title

Tigera Calico信息泄露漏洞

Description

Tigera Calico是美国Tigera公司的一套针对容器、虚拟机和主机工作负载的开源网络安全解决方案。 Tigera Calico 3.14.0及之前版本和Calico Enterprise 2.8.2及之前版本中存在信息泄露漏洞，该漏洞源于程序未正确验证路由器通告，攻击者可借助中间人技术利用该漏洞获取敏感信息。

Severity

低

Patch Name

Tigera Calico信息泄露漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.projectcalico.org/security-bulletins/

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-13597

Impacted products

Name
['Tigera Calico <=3.14.0', 'Tigera Calico Enterprise <=2.8.2']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-13597"
    }
  },
  "description": "Tigera Calico\u662f\u7f8e\u56fdTigera\u516c\u53f8\u7684\u4e00\u5957\u9488\u5bf9\u5bb9\u5668\u3001\u865a\u62df\u673a\u548c\u4e3b\u673a\u5de5\u4f5c\u8d1f\u8f7d\u7684\u5f00\u6e90\u7f51\u7edc\u5b89\u5168\u89e3\u51b3\u65b9\u6848\u3002\n\nTigera Calico 3.14.0\u53ca\u4e4b\u524d\u7248\u672c\u548cCalico Enterprise 2.8.2\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u6b63\u786e\u9a8c\u8bc1\u8def\u7531\u5668\u901a\u544a\uff0c\u653b\u51fb\u8005\u53ef\u501f\u52a9\u4e2d\u95f4\u4eba\u6280\u672f\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.projectcalico.org/security-bulletins/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-31254",
  "openTime": "2021-04-27",
  "patchDescription": "Tigera Calico\u662f\u7f8e\u56fdTigera\u516c\u53f8\u7684\u4e00\u5957\u9488\u5bf9\u5bb9\u5668\u3001\u865a\u62df\u673a\u548c\u4e3b\u673a\u5de5\u4f5c\u8d1f\u8f7d\u7684\u5f00\u6e90\u7f51\u7edc\u5b89\u5168\u89e3\u51b3\u65b9\u6848\u3002\r\n\r\nTigera Calico 3.14.0\u53ca\u4e4b\u524d\u7248\u672c\u548cCalico Enterprise 2.8.2\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u6b63\u786e\u9a8c\u8bc1\u8def\u7531\u5668\u901a\u544a\uff0c\u653b\u51fb\u8005\u53ef\u501f\u52a9\u4e2d\u95f4\u4eba\u6280\u672f\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Tigera Calico\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Tigera Calico \u003c=3.14.0",
      "Tigera Calico Enterprise \u003c=2.8.2"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-13597",
  "serverity": "\u4f4e",
  "submitTime": "2020-06-04",
  "title": "Tigera Calico\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2020-13597 (GCVE-0-2020-13597)

Vulnerability from cvelistv5 – Published: 2020-06-03 16:44 – Updated: 2024-09-16 19:24

Summary

Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod.

Severity ?

6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

CWE

CWE-201 - Information Exposure Through Sent Data

Assigner

Tigera

References

URL

Tags

	https://www.projectcalico.org/security-bulletins/	x_refsource_CONFIRM
	https://groups.google.com/forum/#%21topic/kuberne…	x_refsource_CONFIRM
	https://github.com/kubernetes/kubernetes/issues/91507	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

Tigera Inc

Calico

Affected: 3.14.0
Affected: unspecified , ≤ 3.13.3 (custom)
Affected: unspecified , ≤ 3.12.1 (custom)
Affected: unspecified , ≤ 3.11.2 (custom)
Affected: unspecified , ≤ 3.10.3 (custom)
Affected: unspecified , ≤ 3.9.5 (custom)
Affected: unspecified , ≤ 3.8.8 (custom)
Affected: 3.7.x
Affected: 3.6.x
Affected: 3.5.x
Affected: 3.4.x
Affected: 3.3.x
Affected: 3.2.x
Affected: 3.1.x
Affected: 3.0.x
Affected: 2.6.x
Affected: 2.5.x
Affected: 2.4.x
Affected: 2.3.x
Affected: 2.2.x
Affected: 2.1.x
Affected: 2.0.x
Affected: 1.6.x
Affected: 1.5.x

Tigera Inc

Calico Enterprise

Affected: unspecified , ≤ 2.8.2 (custom)
Affected: unspecified , ≤ 2.7.4 (custom)
Affected: unspecified , ≤ 2.6.2 (custom)
Affected: 2.5.x
Affected: 2.4.x
Affected: 2.3.x
Affected: 2.2.x
Affected: 2.1.x
Affected: 2.0.x

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:25:16.199Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.projectcalico.org/security-bulletins/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21topic/kubernetes-security-announce/BMb_6ICCfp8"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/kubernetes/kubernetes/issues/91507"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Calico",
          "vendor": "Tigera Inc",
          "versions": [
            {
              "status": "affected",
              "version": "3.14.0"
            },
            {
              "lessThanOrEqual": "3.13.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.12.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.11.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.10.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.9.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.8.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.7.x"
            },
            {
              "status": "affected",
              "version": "3.6.x"
            },
            {
              "status": "affected",
              "version": "3.5.x"
            },
            {
              "status": "affected",
              "version": "3.4.x"
            },
            {
              "status": "affected",
              "version": "3.3.x"
            },
            {
              "status": "affected",
              "version": "3.2.x"
            },
            {
              "status": "affected",
              "version": "3.1.x"
            },
            {
              "status": "affected",
              "version": "3.0.x"
            },
            {
              "status": "affected",
              "version": "2.6.x"
            },
            {
              "status": "affected",
              "version": "2.5.x"
            },
            {
              "status": "affected",
              "version": "2.4.x"
            },
            {
              "status": "affected",
              "version": "2.3.x"
            },
            {
              "status": "affected",
              "version": "2.2.x"
            },
            {
              "status": "affected",
              "version": "2.1.x"
            },
            {
              "status": "affected",
              "version": "2.0.x"
            },
            {
              "status": "affected",
              "version": "1.6.x"
            },
            {
              "status": "affected",
              "version": "1.5.x"
            }
          ]
        },
        {
          "product": "Calico Enterprise",
          "vendor": "Tigera Inc",
          "versions": [
            {
              "lessThanOrEqual": "2.8.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.7.4",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.6.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2.5.x"
            },
            {
              "status": "affected",
              "version": "2.4.x"
            },
            {
              "status": "affected",
              "version": "2.3.x"
            },
            {
              "status": "affected",
              "version": "2.2.x"
            },
            {
              "status": "affected",
              "version": "2.1.x"
            },
            {
              "status": "affected",
              "version": "2.0.x"
            }
          ]
        }
      ],
      "datePublic": "2020-06-01T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node\u2019s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-201",
              "description": "CWE-201 Information Exposure Through Sent Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-03T16:44:38",
        "orgId": "e6d453f4-3dae-4941-bcea-9af25f4e824d",
        "shortName": "Tigera"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.projectcalico.org/security-bulletins/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21topic/kubernetes-security-announce/BMb_6ICCfp8"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kubernetes/kubernetes/issues/91507"
        }
      ],
      "source": {
        "advisory": "TTA-2020-001",
        "discovery": "EXTERNAL"
      },
      "title": "Calico nodes IPv6 traffic redirection from route advertisment",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@tigera.io",
          "DATE_PUBLIC": "2020-06-01T16:27:00.000Z",
          "ID": "CVE-2020-13597",
          "STATE": "PUBLIC",
          "TITLE": "Calico nodes IPv6 traffic redirection from route advertisment"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Calico",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "3.14.0"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "3.13.3"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "3.12.1"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "3.11.2"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "3.10.3"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "3.9.5"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "3.8.8"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "3.7.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "3.6.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "3.5.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "3.4.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "3.3.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "3.2.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "3.1.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "3.0.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2.6.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2.5.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2.4.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2.3.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2.2.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2.1.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2.0.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "1.6.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "1.5.x"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Tigera Inc"
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Calico Enterprise",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "2.8.2"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "2.7.4"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "2.6.2"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2.5.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2.4.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2.3.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2.2.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2.1.x"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2.0.x"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Tigera Inc"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node\u2019s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-201 Information Exposure Through Sent Data"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.projectcalico.org/security-bulletins/",
              "refsource": "CONFIRM",
              "url": "https://www.projectcalico.org/security-bulletins/"
            },
            {
              "name": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/BMb_6ICCfp8",
              "refsource": "CONFIRM",
              "url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/BMb_6ICCfp8"
            },
            {
              "name": "https://github.com/kubernetes/kubernetes/issues/91507",
              "refsource": "CONFIRM",
              "url": "https://github.com/kubernetes/kubernetes/issues/91507"
            }
          ]
        },
        "source": {
          "advisory": "TTA-2020-001",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e6d453f4-3dae-4941-bcea-9af25f4e824d",
    "assignerShortName": "Tigera",
    "cveId": "CVE-2020-13597",
    "datePublished": "2020-06-03T16:44:38.089338Z",
    "dateReserved": "2020-05-26T00:00:00",
    "dateUpdated": "2024-09-16T19:24:54.549Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-31254

CVE-2020-13597 (GCVE-0-2020-13597)

Tags

Sightings

Nomenclature