Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-umountUpgrade oci-systemd-hook | May 13, 2022 | Apr 2, 2019 |
| Alpine Linux | — | Upgrade containerd | Aug 22, 2024 | Apr 2, 2019 |
| Centos_linux | — | Upgrade slirp4netns-debuginfoUpgrade podman-debuginfoUpgrade runcUpgrade containernetworking-plugins-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade runc-debuginfoUpgrade slirp4netnsUpgrade slirp4netns-debugsourceUpgrade podman-manpagesUpgrade containernetworking-plugins-debuginfoUpgrade oci-systemd-hook-debuginfoUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade skopeo-testsUpgrade podman-testsUpgrade skopeo-debuginfoUpgrade podman-remoteUpgrade oci-umount-debugsourceUpgrade buildah-debugsourceUpgrade podman-remote-debuginfoUpgrade oci-systemd-hookUpgrade podman-debugsourceUpgrade buildah-tests-debuginfoUpgrade buildah-testsUpgrade cockpit-podmanUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debugsourceUpgrade podmanUpgrade podman-dockerUpgrade buildahUpgrade oci-umount-debuginfoUpgrade skopeo-debugsourceUpgrade containers-commonUpgrade runc-debugsourceUpgrade python-podman-apiUpgrade buildah-debuginfoUpgrade oci-umountUpgrade skopeoUpgrade fuse-overlayfs-debuginfoUpgrade toolbox | Feb 8, 2021 | Apr 2, 2019 |
| Debian | — | Upgrade kubernetes | Jul 30, 2024 | Apr 2, 2019 |
| Kubernetes | — | Upgrade Kubernetes to version 1.12.7Upgrade Kubernetes to version 1.11.9Upgrade Kubernetes to version 1.13.5 | Apr 16, 2019 | Apr 2, 2019 |
| Oracle_linux | — | Upgrade kubernetes-cni-pluginsUpgrade kubeadmUpgrade kubeadm-ha-setupUpgrade kubernetes-cniUpgrade kubeadm-upgradeUpgrade kubeletUpgrade kubectl | Apr 14, 2019 | Mar 28, 2019 |
| Redhat_linux | — | Upgrade buildah-debuginfoUpgrade podman-testsUpgrade toolboxUpgrade podman-dockerUpgrade skopeo-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade oci-systemd-hook-debugsourceUpgrade buildah-debugsourceUpgrade runc-debuginfoUpgrade skopeoUpgrade skopeo-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade buildahUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade oci-umountUpgrade containers-commonUpgrade oci-umount-debuginfoUpgrade buildah-tests-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfsUpgrade podman-debuginfoUpgrade buildah-testsUpgrade podman-remote-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-debugsourceUpgrade oci-umount-debugsourceUpgrade runc-debugsourceUpgrade containernetworking-pluginsUpgrade podman-manpagesUpgrade runcUpgrade slirp4netns-debuginfoUpgrade oci-systemd-hookUpgrade skopeo-testsNo solution existsUpgrade slirp4netns-debugsourceUpgrade container-selinuxUpgrade podman-remoteUpgrade podmanUpgrade python-podman-apiUpgrade oci-systemd-hook-debuginfo | Feb 8, 2021 | Apr 2, 2019 |
| Rocky_linux | — | Upgrade oci-systemd-hookUpgrade oci-umountUpgrade oci-umount-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade oci-umount-debuginfo | Mar 12, 2024 | Apr 2, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 2, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub