{"id":"CVE-2020-13597","details":"Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod.","aliases":["GHSA-pf59-j7c2-rh6x"],"modified":"2026-04-10T04:31:37.045111Z","published":"2020-06-03T17:15:24.887Z","related":["CGA-8w7q-72fp-mwqp"],"references":[{"type":"WEB","url":"https://groups.google.com/forum/#%21topic/kubernetes-security-announce/BMb_6ICCfp8"},{"type":"ADVISORY","url":"https://www.projectcalico.org/security-bulletins/"},{"type":"REPORT","url":"https://github.com/kubernetes/kubernetes/issues/91507"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/projectcalico/calico","events":[{"introduced":"0"},{"last_affected":"1e5a93ab2d29e9dcf51b9d8c3e8a4d87de333dd7"},{"introduced":"0"},{"last_affected":"cfb4a6c29092e990d19d21c3f2a6686c2eca74f3"},{"introduced":"fab86bba2faa52c81ea3ab5e4879b05eda5f7f3a"},{"last_affected":"2a502439d3e7d88e991f4af2ed3f5aed9d37021e"},{"introduced":"7576f11000c9995db7967be415b1ad14bed73754"},{"last_affected":"52c554096ce926898b3d6d6f1544f90ba2999c25"},{"introduced":"83bb665609bf74509e70aa15377b8673e73f42d4"},{"last_affected":"73a2a089264757fad7af0da49af64f5734c37cb2"},{"introduced":"db9625b360f63e3835e34fdeb0386f96386d4c83"},{"last_affected":"ebd19b68e2bd3ff0de1a80042fc71631b9520b56"},{"introduced":"abb849ccca917f397e620fbe2dbefcff2314a3c5"},{"last_affected":"abb849ccca917f397e620fbe2dbefcff2314a3c5"},{"introduced":"0"},{"last_affected":"a938982186262a559aefd5471d4e7fb6ef8ac207"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"2.6.2"},{"introduced":"0"},{"last_affected":"3.8.8"},{"introduced":"3.9.0"},{"last_affected":"3.9.5"},{"introduced":"3.10.0"},{"last_affected":"3.10.3"},{"introduced":"3.11.0"},{"last_affected":"3.11.2"},{"introduced":"3.12.0"},{"last_affected":"3.12.1"},{"introduced":"3.13.0"},{"last_affected":"3.13.3"},{"introduced":"0"},{"last_affected":"3.14.0"}]}}],"versions":["v0.1.0-typha","v0.1.1-typha","v0.1.2-typha","v0.1.3-typha","v0.1.4-typha","v0.1.5-typha","v0.1.7-typha","v0.2.1-typha","v0.2.2-typha","v0.2.3-pre1-typha","v0.2.3-typha","v0.3.0-typha","v0.3.1-typha","v0.4.0-typha","v0.5.0-typha","v0.5.1-typha","v0.6.0-alpha1-rc1-typha","v0.6.0-alpha1-typha","v0.6.0-beta1-typha","v0.6.0-typha","v2.5.0","v2.5.0-calico","v2.5.0-rc2","v2.5.0-rc2-calico","v2.6.0","v2.6.0-calico","v2.6.0-rc1","v2.6.0-rc1-calico","v2.6.0-rc2","v2.6.0-rc2-calico","v2.6.2","v2.6.2-calico","v3.10.0-typha","v3.10.1-typha","v3.10.2-typha","v3.10.3-typha","v3.10.4-typha","v3.11.0-typha","v3.11.1-typha","v3.11.2-typha","v3.12.0-typha","v3.12.1-typha","v3.12.2-typha","v3.12.3-typha","v3.13.0-typha","v3.13.1-typha","v3.13.2-typha","v3.13.3-typha","v3.13.4-typha","v3.13.5-typha","v3.14.0-0.dev-typha","v3.14.0-typha","v3.14.1-typha","v3.14.2-typha","v3.2.0-typha","v3.2.1-typha","v3.3.0-typha","v3.4.0-0.dev-typha","v3.4.0-typha","v3.4.1-typha","v3.5.0-0.dev-typha","v3.5.0-beta.0-typha","v3.5.0-typha","v3.5.1-typha","v3.6.0-0.dev-typha","v3.6.0-typha","v3.6.1-typha","v3.7.0-0.dev-typha","v3.8.0-0.dev-typha","v3.8.0-typha","v3.8.1-typha","v3.8.2-typha","v3.8.3-typha","v3.8.4-typha","v3.8.5-typha","v3.8.6-typha","v3.8.7-typha","v3.8.8-typha","v3.9.0-typha","v3.9.1-typha","v3.9.2-typha","v3.9.3-typha","v3.9.4-typha","v3.9.5-typha","v3.9.6-typha"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-13597.json","unresolved_ranges":[{"events":[{"introduced":"2.7.0"},{"last_affected":"2.7.4"}]},{"events":[{"introduced":"2.8.0"},{"last_affected":"2.8.2"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N"}]}