{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2019-03-28T00:00:00", "descriptions": [{"lang": "en", "value": "Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-06-15T02:06:04", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/containernetworking/plugins/pull/269#issuecomment-477683272"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://security.netapp.com/advisory/ntap-20190416-0002/"}, {"name": "RHBA-2019:0862", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHBA-2019:0862"}, {"name": "FEDORA-2019-d2b57d3b19", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCN66VYB3XS76SYH567SO7N3I254JOCT/"}, {"name": "FEDORA-2019-24217abfdf", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGOOWAELGH3F7OXRBPH3HCNZELNLXYTW/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-9946", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/containernetworking/plugins/pull/269#issuecomment-477683272", "refsource": "CONFIRM", "url": "https://github.com/containernetworking/plugins/pull/269#issuecomment-477683272"}, {"name": "https://security.netapp.com/advisory/ntap-20190416-0002/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20190416-0002/"}, {"name": "RHBA-2019:0862", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHBA-2019:0862"}, {"name": "FEDORA-2019-d2b57d3b19", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCN66VYB3XS76SYH567SO7N3I254JOCT/"}, {"name": "FEDORA-2019-24217abfdf", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGOOWAELGH3F7OXRBPH3HCNZELNLXYTW/"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-9946", "datePublished": "2019-04-02T17:22:52", "dateReserved": "2019-03-23T00:00:00", "dateUpdated": "2019-06-15T02:06:04", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cncf:portmap:*:*:*:*:*:container_networking_interface:*:*", "matchCriteriaId": "AAC9C18B-C6AB-43D0-8BD9-ACC4158DF9FD", "versionEndExcluding": "0.7.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*", "matchCriteriaId": "ADC981F6-485E-4804-8BA2-640DA55FE1D9", "versionEndExcluding": "1.11.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*", "matchCriteriaId": "DDF6BA38-1A7C-46AB-A404-06ABB3ADFFC7", "versionEndExcluding": "1.12.7", "versionStartIncluding": "1.12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*", "matchCriteriaId": "147CD8D3-60A8-4314-AD92-670CB330F85C", "versionEndExcluding": "1.13.5", "versionStartIncluding": "1.13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.13.6:beta0:*:*:*:*:*:*", "matchCriteriaId": "4CC774DD-08F0-4AC4-A0A9-67F86A7ED2E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha0:*:*:*:*:*:*", "matchCriteriaId": "34A6AC2D-82C4-4E1F-8D9A-159E31A4F790", "vulnerable": true}, {"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "002991E8-6CC8-4F58-89B3-0B1AF2447DD5", "vulnerable": true}, {"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "9EA02FED-0377-4E4B-A86F-EE44F0E27360", "vulnerable": true}, {"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:alpha3:*:*:*:*:*:*", "matchCriteriaId": "1496A02B-29F5-4DD5-B9FE-B39C5B77E8CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:beta0:*:*:*:*:*:*", "matchCriteriaId": "59D7C9A1-A467-46A5-A03E-A04BD35287C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "41BF2E7F-E6DB-4ED0-B943-247B4F592C7E", "vulnerable": true}, {"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "EF0406C1-854E-4B4D-AC1E-7DE304356030", "vulnerable": true}, {"criteria": "cpe:2.3:a:kubernetes:kubernetes:1.14.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "300E9B49-446B-406C-B219-360BD97D6EC1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netapp:cloud_insights:-:*:*:*:*:*:*:*", "matchCriteriaId": "26FCA75B-4282-4E0F-95B4-640A82C8E91C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0."}, {"lang": "es", "value": "La interfaz de red del contenedor (CNI) de Cloud Native Computing Foundation (CNCF), en su versi\u00f3n 0.7.4, tiene una configuraci\u00f3n incorrecta en el firewall de red que afecta a Kubernetes. El plugin \"portmat\" de la CNI, utilizado para configurar los puertos de host para la CNI, introduce reglas al frente de las cadenas de iptables NAT. Esto tiene la precedencia sobre la cadena KUBE- SERVICES. Debido a esto, la regla HostPort/portmap podr\u00eda coincidir con el tr\u00e1fico entrante aunque hubiera un ajuste mejor y reglas de definici\u00f3n del servicio m\u00e1s espec\u00edficas como NodePorts m\u00e1s adelante en la cadena. Este problema est\u00e1 resuelto en la versi\u00f3n 0.7.5 de CNI y en las versiones 1.11.9, 1.12.7, 1.13.5 y 1.14.0 de Kubernetes."}], "id": "CVE-2019-9946", "lastModified": "2023-11-07T03:13:49.317", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-04-02T18:30:26.583", "references": [{"source": "cve@mitre.org", "url": "https://access.redhat.com/errata/RHBA-2019:0862"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/containernetworking/plugins/pull/269#issuecomment-477683272"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCN66VYB3XS76SYH567SO7N3I254JOCT/"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGOOWAELGH3F7OXRBPH3HCNZELNLXYTW/"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20190416-0002/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-670"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}