GHSA-pf59-j7c2-rh6x

    Dashboard / Vulnerabilities / GHSA-pf59-j7c2-rh6x

    GHSA-pf59-j7c2-rh6x

    Published: 15 Feb 2022Last Modified: 7 Aug 2026

    Summary: Exposure of Sensitive Information to an Unauthorized Actor and Insertion of Sensitive Information Into Sent Data in Calico

    Details: Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod.

    References: https://nvd.nist.gov/vuln/detail/CVE-2020-13597, https://github.com/kubernetes/kubernetes/issues/91507, https://github.com/containernetworking/plugins/pull/484, https://github.com/containernetworking/plugins/commit/ad10b6fa91aacd720f1f9ab94341a97a82a24965, https://github.com/projectcalico/calico, https://groups.google.com/forum/#!topic/kubernetes-security-announce/BMb_6ICCfp8, https://www.projectcalico.org/security-bulletins

    Affected packages

    Package

    Name: github.com/projectcalico/calico

    Purl: pkg:golang/github.com/projectcalico/calico

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 3.14.0
    Fixed -3.14.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High