SB2019060328 - Fedora 30 update for containernetworking-plugins

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019060328

SB2019060328 - Fedora 30 update for containernetworking-plugins

Published: June 3, 2019 Updated: April 25, 2025

Security Bulletin ID SB2019060328
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Security Features (CVE-ID: CVE-2019-9946)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.


Remediation

Install update from vendor's website.

References