x/vulndb: potential Go vuln in github.com/containernetworking/plugins: CVE-2019-9946

[tatianab]

CVE-2019-9946 references github.com/containernetworking/plugins, which may be a Go module.

Description:
Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2019-9946
• fix: Portmap: append, rather than prepend, entry rules - CVE-2019-9946 containernetworking/plugins#269 (comment)
• web: https://security.netapp.com/advisory/ntap-20190416-0002/
• web: https://access.redhat.com/errata/RHBA-2019:0862
• web: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCN66VYB3XS76SYH567SO7N3I254JOCT/
• web: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGOOWAELGH3F7OXRBPH3HCNZELNLXYTW/
• Imported by: https://pkg.go.dev/github.com/containernetworking/plugins?tab=importedby

Cross references:

• Module github.com/containernetworking/plugins appears in issue x/vulndb: potential Go vuln in github.com/containernetworking/plugins/pkg/ip: GHSA-pf59-j7c2-rh6x #860 NOT_IMPORTABLE
• Module github.com/containernetworking/plugins appears in issue x/vulndb: potential Go vuln in github.com/containernetworking/plugins: GHSA-fx6x-h9g4-56f8 #1915 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/containernetworking/plugins
      vulnerable_at: 1.3.0
      packages:
        - package: n/a
cves:
    - CVE-2019-9946
references:
    - fix: https://github.com/containernetworking/plugins/pull/269#issuecomment-477683272
    - web: https://security.netapp.com/advisory/ntap-20190416-0002/
    - web: https://access.redhat.com/errata/RHBA-2019:0862
    - web: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCN66VYB3XS76SYH567SO7N3I254JOCT/
    - web: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGOOWAELGH3F7OXRBPH3HCNZELNLXYTW/

[gopherbot]

Change https://go.dev/cl/540721 mentions this issue: data/excluded: batch add 135 excluded reports