{"id":"CVE-2019-9946","aliases":["ALPINE-CVE-2019-9946","ALSA-2019:3403","BELL-CVE-2019-9946","DEBIAN-CVE-2019-9946","EUVD-2019-19300","GHSA-6g96-g4m6-hw69","RHBA-2019:0862","RHSA-2019:3403","RLSA-2019:3403","UBUNTU-CVE-2019-9946","openSUSE-SU-2024:10884-1"],"status":"published","title":"Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network...","description":"Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03159,"percentile":0.88067,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-670"],"published":"2019-04-02T17:22:52Z","modified":"2026-11-05T12:15:05Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"containerd","fixed_in":["1.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"containerd","fixed_in":["1.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"containerd","fixed_in":["1.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"containerd","fixed_in":["1.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"containerd","fixed_in":["1.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"containerd","fixed_in":["1.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"containerd","fixed_in":["1.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"containerd","fixed_in":["1.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"containerd","fixed_in":["1.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"containerd","fixed_in":["1.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"containerd","fixed_in":["1.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"containerd","fixed_in":["1.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"containerd","fixed_in":["1.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"containerd","fixed_in":["1.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"containerd","fixed_in":["1.2.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"containerd","fixed_in":["1.2.6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"kubernetes","fixed_in":["1.17.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"kubernetes","fixed_in":["1.17.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kubernetes","fixed_in":["1.17.4-1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"containernetworking-plugins","fixed_in":["0:0.7.5-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"containernetworking-plugins-debuginfo","fixed_in":["0:0.7.5-2.el7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-systemd-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-systemd-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-systemd-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-umount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-2.git87f9237.module_el8.5.0+119+9a9ec082"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-umount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-2.git87f9237.module_el8.4.0+2496+12421f43"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-umount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-2.git87f9237.module_el8.3.0+2044+12421f43"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.4-1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.5-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"containernetworking-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.5-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4-1.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"container-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.107-2.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-2.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-2.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-2.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.37-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-1.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-1.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-1.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-systemd-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-systemd-hook-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-systemd-hook-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-umount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-umount-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-umount-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-manpages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-podman-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.1.gitd0a45fe.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-60.rc8.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-60.rc8.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-60.rc8.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.37-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.37-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.37-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.37-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.1.0+4306+1d917805"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.1.0+4306+1d917805"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.1.0+4306+1d917805"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.4-1.module+el8.1.0+4081+b29780af"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"oci-systemd-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"oci-umount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-2.git87f9237.module+el8.4.0+557+48ba8b2f"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"k3s","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.3+k3s1-1.2"}]}],"bundled":2}],"products":[{"vendor":"cncf","product":"portmap"},{"vendor":"kubernetes","product":"kubernetes"},{"vendor":"netapp","product":"cloud_insights"}],"references":[{"url":"https://github.com/containernetworking/plugins/pull/269#issuecomment-477683272","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://security.netapp.com/advisory/ntap-20190416-0002/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0862","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCN66VYB3XS76SYH567SO7N3I254JOCT/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGOOWAELGH3F7OXRBPH3HCNZELNLXYTW/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9946","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCN66VYB3XS76SYH567SO7N3I254JOCT/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGOOWAELGH3F7OXRBPH3HCNZELNLXYTW/"},{"url":"https://github.com/advisories/GHSA-6g96-g4m6-hw69"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-9946","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3403","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1655211","tags":["report"]},{"url":"https://bugzilla.redhat.com/1661597","tags":["report"]},{"url":"https://bugzilla.redhat.com/1671023","tags":["report"]},{"url":"https://bugzilla.redhat.com/1672581","tags":["report"]},{"url":"https://bugzilla.redhat.com/1674519","tags":["report"]},{"url":"https://bugzilla.redhat.com/1677251","tags":["report"]},{"url":"https://bugzilla.redhat.com/1677264","tags":["report"]},{"url":"https://bugzilla.redhat.com/1689255","tags":["report"]},{"url":"https://bugzilla.redhat.com/1690514","tags":["report"]},{"url":"https://bugzilla.redhat.com/1691543","tags":["report"]},{"url":"https://bugzilla.redhat.com/1692513","tags":["report"]},{"url":"https://bugzilla.redhat.com/1692712","tags":["report"]},{"url":"https://bugzilla.redhat.com/1693154","tags":["report"]},{"url":"https://bugzilla.redhat.com/1693424","tags":["report"]},{"url":"https://bugzilla.redhat.com/1707220","tags":["report"]},{"url":"https://bugzilla.redhat.com/1719626","tags":["report"]},{"url":"https://bugzilla.redhat.com/1719994","tags":["report"]},{"url":"https://bugzilla.redhat.com/1720646","tags":["report"]},{"url":"https://bugzilla.redhat.com/1720654","tags":["report"]},{"url":"https://bugzilla.redhat.com/1721247","tags":["report"]},{"url":"https://bugzilla.redhat.com/1721638","tags":["report"]},{"url":"https://bugzilla.redhat.com/1723879","tags":["report"]},{"url":"https://bugzilla.redhat.com/1728700","tags":["report"]},{"url":"https://bugzilla.redhat.com/1730281","tags":["report"]},{"url":"https://bugzilla.redhat.com/1731117","tags":["report"]},{"url":"https://bugzilla.redhat.com/1732508","tags":["report"]},{"url":"https://bugzilla.redhat.com/1734745","tags":["report"]},{"url":"https://bugzilla.redhat.com/1734809","tags":["report"]},{"url":"https://bugzilla.redhat.com/1737077","tags":["report"]},{"url":"https://bugzilla.redhat.com/1739961","tags":["report"]},{"url":"https://bugzilla.redhat.com/1740079","tags":["report"]},{"url":"https://bugzilla.redhat.com/1741157","tags":["report"]},{"url":"https://bugzilla.redhat.com/1743685","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2019-3403.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-10214","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-14378","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9946","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-9946","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-9946","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1693406","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_0862.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1692712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9946","tags":["advisory","report"]},{"url":"https://discuss.kubernetes.io/t/announce-security-release-of-kubernetes-affecting-certain-network-configurations-with-cni-releases-1-11-9-1-12-7-1-13-5-and-1-14-0-cve-2019-9946/5713","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1655211","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1661597","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1671023","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1672581","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1674519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677251","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1689255","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690514","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1691543","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1692513","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1693154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1693424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1707220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1719626","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1719994","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1721247","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1721638","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723879","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1728700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1730281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1731117","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732508","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734745","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1737077","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1739961","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1740079","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1741157","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1743685","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3403.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10214","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10214","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10214","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14378","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14378","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14378","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2019:3403","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-9946","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1002101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9946","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-9946","description":"Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.","status":"published","published":"2019-04-02T17:22:52Z","modified":"2024-08-04T22:10:08.508Z","updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2019-19300","description":"Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.","status":"published","published":"2019-04-02T17:22:52Z","modified":"2024-08-04T22:10:08Z","updated_at":"2026-11-03T02:40:54.59684Z"}],"ghsa":[{"id":"GHSA-6g96-g4m6-hw69","title":"Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network...","description":"Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.","status":"published","published":"2022-05-13T01:23:07Z","modified":"2023-02-01T05:06:59Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T14:50:27.906349Z"}],"nvd":[{"id":"CVE-2019-9946","description":"Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.","status":"published","published":"2019-04-02T18:30:26.583Z","modified":"2026-06-17T02:44:54.43Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T14:05:09.523883Z"}],"osv":[{"id":"ALPINE-CVE-2019-9946","description":"Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.","status":"published","published":"2019-04-02T18:30:26.583Z","modified":"2026-11-03T06:32:23.160617446Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"BELL-CVE-2019-9946","title":"CVE-2019-9946 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:47.865999Z","modified":"2026-01-26T09:46:58.171247Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-9946","description":"Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.","status":"published","published":"2019-04-02T18:30:26.583Z","modified":"2026-10-29T11:12:11.930950694Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"DEBIAN-CVE-2019-9946","description":"Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.","status":"published","published":"2019-04-02T18:30:26.583Z","modified":"2026-09-21T07:00:47.931718784Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"RHBA-2019:0862","title":"Red Hat Bug Fix Advisory: containernetworking-plugins bug fix and enhancement update","status":"published","published":"2024-09-13T21:58:48Z","modified":"2025-11-22T11:38:05Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"RHSA-2019:3403","title":"Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update","status":"published","published":"2024-09-16T02:38:13Z","modified":"2026-06-28T10:32:53Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RLSA-2019:3403","title":"Important: container-tools:rhel8 security, bug fix, and enhancement update","description":"The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.\n\nSecurity Fix(es):\n\n* QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)\n\n* containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure (CVE-2019-10214)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section.","status":"published","published":"2019-11-05T17:41:57Z","modified":"2026-02-05T11:00:04.438068Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-9946","description":"Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.","status":"withdrawn","published":"2019-04-02T18:30:00Z","modified":"2025-07-14T06:45:16.364674Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"ALSA-2019:3403","title":"Important: container-tools:rhel8 security, bug fix, and enhancement update","description":"The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.\n\nSecurity Fix(es):\n\n* QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)\n\n* containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure (CVE-2019-10214)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2019-11-05T17:41:57Z","modified":"2026-11-05T12:15:05.004012175Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"openSUSE-SU-2024:10884-1","title":"k3s-1.21.3+k3s1-1.2 on GA media","description":"These are all security issues fixed in the k3s-1.21.3+k3s1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:20:53.553364Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}