Every CVE Search/ Get API key

CVE-2019-9946

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network...

7.5 HighFix available

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

3.16%Up 1.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.

Record
CVE-2019-9946
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-670
Updated
2026-11-02
CVE List No score

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.

Record
CVE-2019-9946
Updated
2026-11-02
EUVDEUVD-2019-19300 No score

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.

Record
EUVD-2019-19300
Updated
2026-11-03
GitHub AdvisoriesGHSA-6g96-g4m6-hw69 7.5

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network...

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.

Record
GHSA-6g96-g4m6-hw69
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-670
Updated
2026-11-02
OSVALPINE-CVE-2019-9946 7.5

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.

Record
ALPINE-CVE-2019-9946
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSVBELL-CVE-2019-9946 7.5

CVE-2019-9946 does not affect BellSoft software

Record
BELL-CVE-2019-9946
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 8 moreShow less
OSV 7.5

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.

Record
CVE-2019-9946
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2019-9946 7.5

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.

Record
DEBIAN-CVE-2019-9946
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHBA-2019:0862 6.5

Red Hat Bug Fix Advisory: containernetworking-plugins bug fix and enhancement update

Record
RHBA-2019:0862
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVRHSA-2019:3403 7.0

Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update

Record
RHSA-2019:3403
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2019:3403 7.0

Important: container-tools:rhel8 security, bug fix, and enhancement update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

  • QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

  • containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure (CVE-2019-10214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section.

Record
RLSA-2019:3403
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-9946 7.5

Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.

Record
UBUNTU-CVE-2019-9946
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVALSA-2019:3403 No score

Important: container-tools:rhel8 security, bug fix, and enhancement update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

  • QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

  • containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure (CVE-2019-10214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2019:3403
Updated
2026-11-02
OSVopenSUSE-SU-2024:10884-1 No score

k3s-1.21.3+k3s1-1.2 on GA media

These are all security issues fixed in the k3s-1.21.3+k3s1-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10884-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
containerd
Alpine:v3.10
 before 1.2.6-r0
1.2.6-r0
containerd
Alpine:v3.11
 before 1.2.6-r0
1.2.6-r0
containerd
Alpine:v3.12
 before 1.2.6-r0
1.2.6-r0
containerd
Alpine:v3.13
 before 1.2.6-r0
1.2.6-r0
containerd
Alpine:v3.14
 before 1.2.6-r0
1.2.6-r0
containerd
Alpine:v3.15
 before 1.2.6-r0
1.2.6-r0
containerd
Alpine:v3.16
 before 1.2.6-r0
1.2.6-r0
containerd
Alpine:v3.17
 before 1.2.6-r0
1.2.6-r0
containerd
Alpine:v3.18
 before 1.2.6-r0
1.2.6-r0
containerd
Alpine:v3.19
 before 1.2.6-r0
1.2.6-r0
Show 60 moreShow less
Affected packages
PackageAffectedFixed
containerd
Alpine:v3.20
 before 1.2.6-r0
1.2.6-r0
containerd
Alpine:v3.21
 before 1.2.6-r0
1.2.6-r0
containerd
Alpine:v3.22
 before 1.2.6-r0
1.2.6-r0
containerd
Alpine:v3.23
 before 1.2.6-r0
1.2.6-r0
containerd
Alpine:v3.24
 before 1.2.6-r0
1.2.6-r0
containerd
Alpine:v3.9
 before 1.2.6
1.2.6
oci-systemd-hook
AlmaLinux:8
 before 1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082
1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082
oci-systemd-hook
AlmaLinux:8
 before 1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43
1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43
oci-systemd-hook
AlmaLinux:8
 before 1:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43
1:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43
oci-umount
AlmaLinux:8
 before 2:2.3.4-2.git87f9237.module_el8.5.0+119+9a9ec082
2:2.3.4-2.git87f9237.module_el8.5.0+119+9a9ec082
oci-umount
AlmaLinux:8
 before 2:2.3.4-2.git87f9237.module_el8.4.0+2496+12421f43
2:2.3.4-2.git87f9237.module_el8.4.0+2496+12421f43
oci-umount
AlmaLinux:8
 before 2:2.3.4-2.git87f9237.module_el8.3.0+2044+12421f43
2:2.3.4-2.git87f9237.module_el8.3.0+2044+12421f43
kubernetes
Debian:12
 before 1.17.4-1
1.17.4-1
kubernetes
Debian:13
 before 1.17.4-1
1.17.4-1
kubernetes
Debian:14
 before 1.17.4-1
1.17.4-1
containernetworking-plugins
Red Hat:rhel_extras_other:7
 before 0:0.7.5-2.el7
0:0.7.5-2.el7
containernetworking-plugins-debuginfo
Red Hat:rhel_extras_other:7
 before 0:0.7.5-2.el7
0:0.7.5-2.el7
buildah
Red Hat:enterprise_linux:8::appstream
 before 0:1.9.0-5.module+el8.1.0+4240+893c1ab8
0:1.9.0-5.module+el8.1.0+4240+893c1ab8
buildah-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.9.0-5.module+el8.1.0+4240+893c1ab8
0:1.9.0-5.module+el8.1.0+4240+893c1ab8
buildah-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.9.0-5.module+el8.1.0+4240+893c1ab8
0:1.9.0-5.module+el8.1.0+4240+893c1ab8
buildah-tests
Red Hat:enterprise_linux:8::appstream
 before 0:1.9.0-5.module+el8.1.0+4240+893c1ab8
0:1.9.0-5.module+el8.1.0+4240+893c1ab8
buildah-tests-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.9.0-5.module+el8.1.0+4240+893c1ab8
0:1.9.0-5.module+el8.1.0+4240+893c1ab8
cockpit-podman
Red Hat:enterprise_linux:8::appstream
 before 0:4-1.module+el8.1.0+4081+b29780af
0:4-1.module+el8.1.0+4081+b29780af
container-selinux
Red Hat:enterprise_linux:8::appstream
 before 2:2.107-2.module+el8.1.0+4081+b29780af
2:2.107-2.module+el8.1.0+4081+b29780af
containernetworking-plugins
Red Hat:enterprise_linux:8::appstream
 before 0:0.8.1-2.module+el8.1.0+4081+b29780af
0:0.8.1-2.module+el8.1.0+4081+b29780af
containernetworking-plugins-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.8.1-2.module+el8.1.0+4081+b29780af
0:0.8.1-2.module+el8.1.0+4081+b29780af
containernetworking-plugins-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:0.8.1-2.module+el8.1.0+4081+b29780af
0:0.8.1-2.module+el8.1.0+4081+b29780af
containers-common
Red Hat:enterprise_linux:8::appstream
 before 1:0.1.37-5.module+el8.1.0+4240+893c1ab8
1:0.1.37-5.module+el8.1.0+4240+893c1ab8
fuse-overlayfs
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.1-1.module+el8.1.0+4081+b29780af
0:0.4.1-1.module+el8.1.0+4081+b29780af
fuse-overlayfs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.1-1.module+el8.1.0+4081+b29780af
0:0.4.1-1.module+el8.1.0+4081+b29780af
fuse-overlayfs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.1-1.module+el8.1.0+4081+b29780af
0:0.4.1-1.module+el8.1.0+4081+b29780af
oci-systemd-hook
Red Hat:enterprise_linux:8::appstream
 before 1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af
1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af
oci-systemd-hook-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af
1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af
oci-systemd-hook-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af
1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af
oci-umount
Red Hat:enterprise_linux:8::appstream
 before 2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af
2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af
oci-umount-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af
2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af
oci-umount-debugsource
Red Hat:enterprise_linux:8::appstream
 before 2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af
2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af
podman
Red Hat:enterprise_linux:8::appstream
 before 0:1.4.2-5.module+el8.1.0+4240+893c1ab8
0:1.4.2-5.module+el8.1.0+4240+893c1ab8
podman-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.4.2-5.module+el8.1.0+4240+893c1ab8
0:1.4.2-5.module+el8.1.0+4240+893c1ab8
podman-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.4.2-5.module+el8.1.0+4240+893c1ab8
0:1.4.2-5.module+el8.1.0+4240+893c1ab8
podman-docker
Red Hat:enterprise_linux:8::appstream
 before 0:1.4.2-5.module+el8.1.0+4240+893c1ab8
0:1.4.2-5.module+el8.1.0+4240+893c1ab8
podman-manpages
Red Hat:enterprise_linux:8::appstream
 before 0:1.4.2-5.module+el8.1.0+4240+893c1ab8
0:1.4.2-5.module+el8.1.0+4240+893c1ab8
podman-remote
Red Hat:enterprise_linux:8::appstream
 before 0:1.4.2-5.module+el8.1.0+4240+893c1ab8
0:1.4.2-5.module+el8.1.0+4240+893c1ab8
podman-remote-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.4.2-5.module+el8.1.0+4240+893c1ab8
0:1.4.2-5.module+el8.1.0+4240+893c1ab8
podman-tests
Red Hat:enterprise_linux:8::appstream
 before 0:1.4.2-5.module+el8.1.0+4240+893c1ab8
0:1.4.2-5.module+el8.1.0+4240+893c1ab8
python-podman-api
Red Hat:enterprise_linux:8::appstream
 before 0:1.2.0-0.1.gitd0a45fe.module+el8.1.0+4081+b29780af
0:1.2.0-0.1.gitd0a45fe.module+el8.1.0+4081+b29780af
runc
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.0-60.rc8.module+el8.1.0+4081+b29780af
0:1.0.0-60.rc8.module+el8.1.0+4081+b29780af
runc-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.0-60.rc8.module+el8.1.0+4081+b29780af
0:1.0.0-60.rc8.module+el8.1.0+4081+b29780af
runc-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.0-60.rc8.module+el8.1.0+4081+b29780af
0:1.0.0-60.rc8.module+el8.1.0+4081+b29780af
skopeo
Red Hat:enterprise_linux:8::appstream
 before 1:0.1.37-5.module+el8.1.0+4240+893c1ab8
1:0.1.37-5.module+el8.1.0+4240+893c1ab8
skopeo-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:0.1.37-5.module+el8.1.0+4240+893c1ab8
1:0.1.37-5.module+el8.1.0+4240+893c1ab8
skopeo-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:0.1.37-5.module+el8.1.0+4240+893c1ab8
1:0.1.37-5.module+el8.1.0+4240+893c1ab8
skopeo-tests
Red Hat:enterprise_linux:8::appstream
 before 1:0.1.37-5.module+el8.1.0+4240+893c1ab8
1:0.1.37-5.module+el8.1.0+4240+893c1ab8
slirp4netns
Red Hat:enterprise_linux:8::appstream
 before 0:0.3.0-4.module+el8.1.0+4306+1d917805
0:0.3.0-4.module+el8.1.0+4306+1d917805
slirp4netns-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.3.0-4.module+el8.1.0+4306+1d917805
0:0.3.0-4.module+el8.1.0+4306+1d917805
slirp4netns-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:0.3.0-4.module+el8.1.0+4306+1d917805
0:0.3.0-4.module+el8.1.0+4306+1d917805
toolbox
Red Hat:enterprise_linux:8::appstream
 before 0:0.0.4-1.module+el8.1.0+4081+b29780af
0:0.0.4-1.module+el8.1.0+4081+b29780af
oci-systemd-hook
Rocky Linux:8
 before 1:0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f
1:0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f
oci-umount
Rocky Linux:8
 before 2:2.3.4-2.git87f9237.module+el8.4.0+557+48ba8b2f
2:2.3.4-2.git87f9237.module+el8.4.0+557+48ba8b2f
k3s
openSUSE:Tumbleweed
 before 1.21.3+k3s1-1.2
1.21.3+k3s1-1.2

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-9946 is a high vulnerability (CVSS 7.5) in Cncf Portmap, published April 2, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.16%, the 87th percentile. Fixed in containerd 1.2.6-r0.

References

Show 62 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open