CVE-2020-1749

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-174905.5The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.CVE-2020-174945.3Untangle Firewall NG before 16.0 uses MD5 for passwords.CVE-2020-174957.5django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. T CVE-2020-174969.8vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel CVE-2020-174978.1eapol.c in iNet wireless daemon (IWD) through 1.8 allows attackers to trigger a PTK reinstallation by retransmitting EAPOL Msg4/4.CVE-2020-174986.5In Wireshark 3.2.0 to 3.2.5, the Kafka protocol dissector could crash. This was addressed in epan/dissectors/packet-kafka.c by avoiding a do CVE-2020-17506.5A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amoun CVE-2020-175009.8Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection (issue 1 of 4). The NDN-210 has CVE-2020-175027.2Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4). The NDN-210 has a web administration panel which is made available ove CVE-2020-175037.2The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authentica CVE-2020-175047.2The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authentica CVE-2020-175058.8Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These c