{"containers": {"cna": {"affected": [{"product": "Weave", "vendor": "weaveworks", "versions": [{"status": "affected", "version": "< 2.6.3"}]}], "descriptions": [{"lang": "en", "value": "In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it's pretty likely that ipv6 forwarding is disabled, ie /proc/sys/net/ipv6/conf//forwarding == 0. Also by default, /proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configure the IPv6 stack using them. By sending rogue router advertisements, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker controlled container. Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond. If by chance you also have on the host a vulnerability like last year's RCE in apt (CVE-2019-3462), you can now escalate to the host. Weave Net version 2.6.3 disables the accept_ra option on the veth devices that it creates."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-350", "description": "CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-06-03T22:55:13", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/weaveworks/weave/security/advisories/GHSA-59qg-grp7-5r73"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/weaveworks/weave/commit/15f21f1899060f7716c70a8555a084e836f39a60"}], "source": {"advisory": "GHSA-59qg-grp7-5r73", "discovery": "UNKNOWN"}, "title": "Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2020-11091", "STATE": "PUBLIC", "TITLE": "Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Weave", "version": {"version_data": [{"version_value": "< 2.6.3"}]}}]}, "vendor_name": "weaveworks"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it's pretty likely that ipv6 forwarding is disabled, ie /proc/sys/net/ipv6/conf//forwarding == 0. Also by default, /proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configure the IPv6 stack using them. By sending rogue router advertisements, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker controlled container. Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond. If by chance you also have on the host a vulnerability like last year's RCE in apt (CVE-2019-3462), you can now escalate to the host. Weave Net version 2.6.3 disables the accept_ra option on the veth devices that it creates."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action"}]}]}, "references": {"reference_data": [{"name": "https://github.com/weaveworks/weave/security/advisories/GHSA-59qg-grp7-5r73", "refsource": "CONFIRM", "url": "https://github.com/weaveworks/weave/security/advisories/GHSA-59qg-grp7-5r73"}, {"name": "https://github.com/weaveworks/weave/commit/15f21f1899060f7716c70a8555a084e836f39a60", "refsource": "MISC", "url": "https://github.com/weaveworks/weave/commit/15f21f1899060f7716c70a8555a084e836f39a60"}]}, "source": {"advisory": "GHSA-59qg-grp7-5r73", "discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-11091", "datePublished": "2020-06-03T22:55:13", "dateReserved": "2020-03-30T00:00:00", "dateUpdated": "2020-06-03T22:55:13", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:weave:weave_net:*:*:*:*:*:*:*:*", "matchCriteriaId": "7C177AA9-82EE-41B6-82E8-B83E18077046", "versionEndExcluding": "2.6.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it's pretty likely that ipv6 forwarding is disabled, ie /proc/sys/net/ipv6/conf//forwarding == 0. Also by default, /proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configure the IPv6 stack using them. By sending rogue router advertisements, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker controlled container. Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond. If by chance you also have on the host a vulnerability like last year's RCE in apt (CVE-2019-3462), you can now escalate to the host. Weave Net version 2.6.3 disables the accept_ra option on the veth devices that it creates."}, {"lang": "es", "value": "En Weave Net versiones anteriores a 2.6.3, un atacante capaz de ejecutar un proceso como root en un contenedor puede responder a las peticiones DNS del host y, por lo tanto, insertarse como un servicio falso. En un cl\u00faster con una red interna IPv4, si IPv6 no est\u00e1 totalmente deshabilitado en el host (por medio de ipv6.disable=1 en el cmdline del kernel), no estar\u00e1 desconfigurado o configurado en algunas interfaces, pero es muy probable que el reenv\u00edo ipv6 este deshabilitado, es decir, /proc/sys/net/ipv6/conf//forwarding == 0. Tambi\u00e9n por defecto, /proc/sys/net/ipv6/conf//accept_ra == 1. La combinaci\u00f3n de estos 2 sysctls significa que el host acepta anuncios de enrutadores y configura la pila IPv6 us\u00e1ndolos. Mediante el env\u00edo de anuncios de enrutadores maliciosos, un atacante puede reconfigurar el host para redireccionar parte o la totalidad del tr\u00e1fico IPv6 del host hacia un contenedor controlado por el atacante. Incluso si antes no hab\u00eda tr\u00e1fico IPv6, si el DNS devuelve registros A (IPv4) y AAAA (IPv6), muchas bibliotecas HTTP intentar\u00e1n conectarse primero por medio de IPv6 y luego recurrir\u00e1n a IPv4, dando una oportunidad al atacante para responder. Si por casualidad tambi\u00e9n se presentar\u00e1n en el host una vulnerabilidad como RCE del a\u00f1o pasado en apt (CVE-2019-3462), ahora puede escalar al host. Weave Net versi\u00f3n 2.6.3 deshabilita la opci\u00f3n accept_ra en los dispositivos veth que crea"}], "id": "CVE-2020-11091", "lastModified": "2020-06-09T20:02:46.830", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2020-06-03T23:15:11.167", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/weaveworks/weave/commit/15f21f1899060f7716c70a8555a084e836f39a60"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/weaveworks/weave/security/advisories/GHSA-59qg-grp7-5r73"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-350"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}