CVEvulnerability

CVE-2020-13597

3.5 LOW Published 2020-06-03 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-06-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.0 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS 3.1 ([email protected])
3.5 LOW — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:N/AC:H/Au:S/C:P/I:N/A:N
Weaknesses
CWE-200, CWE-201

Description

Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod.

Affected configurations

• projectcalico calico (<= 2.6.2) • projectcalico calico (<= 3.8.8) • projectcalico calico (>= 2.7.0 <= 2.7.4) • projectcalico calico (>= 2.8.0 <= 2.8.2) • projectcalico calico (>= 3.9.0 <= 3.9.5) • projectcalico calico (>= 3.10.0 <= 3.10.3) • projectcalico calico (>= 3.11.0 <= 3.11.2) • projectcalico calico (>= 3.12.0 <= 3.12.1) • projectcalico calico (>= 3.13.0 <= 3.13.3) • projectcalico calico 3.14.0

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness

References