Information disclosure in Projectcalico Calico
CVE-2020-13597
Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod.
EPSS: 0.009 (56.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L.
Affected products
- Projectcalico Calico — versions 3.14.0
- Tigera Inc Calico — versions 3.14.0, unspecified, 3.7.x
- Tigera Inc Calico Enterprise — versions unspecified, 2.5.x, 2.4.x
Weakness classification (CWE)
References
- psirt@tigera.io (x_refsource_CONFIRM, Vendor Advisory)
- psirt@tigera.io (x_refsource_CONFIRM)
- psirt@tigera.io (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2020-13597?
- CVE-2020-13597 is a medium-severity vulnerability in Projectcalico Calico, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 6.0/10. Published 2020-06-03.
- How severe is CVE-2020-13597?
- Medium severity. CVSS v3 base score is 6.0 out of 10.