Vulnerability in github.com/weaveworks/weave (CVE-2020-11091)
Summary
Vulnerability in github.com/weaveworks/weave (CVE-2020-11091). Data can be tampered with by attackers. Mitigation: upgrade to 2.6.3 or later.
Original description
The description as published by the source.
Impact
An attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service.
In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it’s pretty likely that ipv6 forwarding is disabled, ie /proc/sys/net/ipv6/conf//forwarding == 0. Also by default, /proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configure the IPv6 stack using them.
By sending “rogue” router advertisements, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker controlled container.
Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond.
If by chance you also have on the host a vulnerability like last year’s RCE in apt (CVE-2019-3462), you can now escalate to the host.
Patches
Weave Net version 2.6.3 (to be released soon) will disable the accept_ra option on the veth devices that it creates.
Workarounds
Users should not run containers with CAP_NET_RAW capability. This has been the advice from Weave Net for years.
https://www.weave.works/docs/net/latest/kubernetes/kube-add…
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2020-11091 has been found in github.com/weaveworks/weave.
Data can be tampered with by attackers.
What to do: upgrade github.com/weaveworks/weave to 2.6.3 or later.
If unsure, ask your IT team or search "github.com/weaveworks/weave CVE-2020-11091" on the vendor's site.
CVE-2020-11091 (github.com/weaveworks/weave) — CWE-350
Attack vector: remote (network-reachable) / no user interaction
Patched: 2.6.3 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-350) exists in github.com/weaveworks/weave.
Check the vendor advisory for the affected versions of github.com/weaveworks/weave.
Severity: ?. Data can be tampered with by attackers.
Update to 2.6.3.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'github.com/weaveworks/weave' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'github.com/weaveworks/weave' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
github.com/weaveworks/weaveを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade github.com/weaveworks/weave to 2.6.3ステージング環境で 2.6.3 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- web github.com
- web github.com