Information disclosure in Projectcalico Calico
CVE-2020-13597
Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.009 (58.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 58.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- Projectcalico Calico — versions 3.14.0
- Tigera Inc Calico — versions 3.14.0, unspecified, 3.7.x
- Tigera Inc Calico Enterprise — versions unspecified, 2.5.x, 2.4.x
Weakness classification (CWE)
References
- www.projectcalico.org/security-bulletins/ (Vendor Advisory)
- groups.google.com/forum/
- github.com/kubernetes/kubernetes/issues/91507 (Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2020-13597?
- CVE-2020-13597 is a medium-severity vulnerability in Projectcalico Calico, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 6.0/10. Published 2020-06-03.
- How severe is CVE-2020-13597?
- Medium severity. CVSS v3 base score is 6.0 out of 10.