Fedora 32 update for moby-engine



| Updated: 2025-04-25
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2020-13401
CWE-ID CWE-451
Exploitation vector Local network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
 Fedora
Operating systems & Components / Operating system

moby-engine
Operating systems & Components / Operating system package or component

Vendor Fedoraproject

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Spoofing attack

EUVDB-ID: #VU28556

Risk: Medium

CVSSv4.0: 2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2020-13401

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of IPv6 router advertisements. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 32

moby-engine: before 19.03.11-1.ce.git42e35e6.fc32

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2020-6d7deafd81


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###