---
title: "Security Bulletins – TTA-2019-002"
source: "https://wordpress-1075849-4005834.cloudwaysapps.com/security-bulletins-tta-2019-002/"
---

# Security Bulletins

Fixes available for vulnerability in VXLAN and IPIP overlay modes

Description
Severity
Notes

## Fixes available for vulnerability in VXLAN and IPIP overlay modes

Reference: TTA-2019-002

Date published: 2019-July-1

High
N/A

### Summary

Clusters using VXLAN or IPIP overlays are vulnerable to malicious cluster users being able to potentially violate network policies or spoof their IP addresses. Upgrade to latest Calico or Tigera Secure releases to close this vulnerability.

### Severity

HIGH

Affects clusters that use VXLAN or IPIP overlays, including Calico, Tigera Secure, and Canal (Calico policy on Flannel). Clusters which use neither of these, or use Calico policy in conjunction with a cloud-provider CNI (e.g. aws-vpc-cni) are not affected.

Allows a malicious cluster user with permission to create pods to potentially bypass Egress policies assigned to their pod (workload endpoint), or potentially spoof IP addresses and make it look like sent packets are from some other pod (workload endpoint). This could potentially allow a malicious user to bypass Ingress policy and send unauthorized packets to other pods (workload endpoints) in the cluster.

Furthermore in IPIP mode, the vulnerability might allow an attacker to prevent other workloads in the cluster from communicating, or redirect traffic intended to other workloads to itself.

### Affected Releases

Calico

- 3.7.3 and older

- 3.6.3 and older

- 3.5.6 and older

- 3.4.x

- 3.3.x

- 3.2.x

- 3.1.x

- 3.0.x

- 2.x

- 1.x

Calico for Windows

- 3.7.0

Tigera Secure Enterprise Edition

- 2.4.1 and older

- 2.3.2 and older

- 2.2.x

- 2.1.x

- 2.0.x

- 1.x

Tigera Secure Cloud Edition: not affected

### Indicators of Impact/Compromise

In VXLAN mode:

Conntrack entries or flow logs from a pod IP to a node IP on UDP port 4789.

In IPIP mode:

Contrack entries or flow logs from a pod IP to a node IP using protocol 4 (IPIP).

### Workaround / Remediation

In order to exploit the vulnerability, a malicious pod must transmit packets to node IP addresses. You can prevent this by using an Egress policy. Do this if you cannot upgrade immediately to a fixed version.

If you are using VXLAN, deny egress to destination UDP port 4789.

If you are using IPIP, deny egress on protocol 4, which is IPIP encapsulation.

Note that if you apply an egress policy to pods, this sets the default action to deny, so be sure to whitelist any legitimate traffic from your applications. In Tigera Secure Enterprise Edition, you can use a high-order tier to deny problematic traffic without affecting the default action in lower-order tiers (e.g. the default tier).

### Fixed Software

Calico

- 3.8.0 (Available on July 2, 2019)

- 3.7.4

- 3.6.4

- 3.5.7

Tigera Secure Enterprise Edition

- 2.4.2

- 2.3.3

[Return to List](https://wordpress-1075849-4005834.cloudwaysapps.com/security-bulletins/)

<!-- plugin=object-cache-pro client=phpredis metric#hits=5703 metric#misses=17 metric#hit-ratio=99.7 metric#bytes=2052165 metric#prefetches=0 metric#store-reads=392 metric#store-writes=14 metric#store-hits=390 metric#store-misses=6 metric#sql-queries=30 metric#ms-total=1304.20 metric#ms-cache=72.37 metric#ms-cache-avg=0.1787 metric#ms-cache-ratio=5.6 sample#redis-hits=73554452 sample#redis-misses=9014273 sample#redis-hit-ratio=89.1 sample#redis-ops-per-sec=218 sample#redis-evicted-keys=0 sample#redis-used-memory=103460184 sample#redis-used-memory-rss=104202240 sample#redis-memory-fragmentation-ratio=1.0 sample#redis-connected-clients=1 sample#redis-tracking-clients=0 sample#redis-rejected-connections=0 sample#redis-keys=16627 -->