CVE-2019-9946 - CVE House
Back to Database
Status published High CVE-2019-9946

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4...

Vulnerability Description

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9946

Credits & Attribution

No credits recorded in the NVD database.

References

More from cncf

View All →
CVE-2021-27099
In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1,...
Medium 6.8
CVE-2021-27098
In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2,...
High 8.1
CVE-2020-8664
CNCF Envoy through 1.13.0 has incorrect Access Control when using...
Medium 5.3
CVE-2020-8661
CNCF Envoy through 1.13.0 may consume excessive amounts of memory...
High 7.5
CVE-2020-8659
CNCF Envoy through 1.13.0 may consume excessive amounts of memory...
High 7.5

Affected Vendor

Affected Software

portmap, kubernetes, cloud insights
Vulnerable Versions:
0, 1.12.0, 1.13.0, 1.13.6, 1.14.0

Timeline

Official Publish: April 2nd, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.