CVE-2025-67499 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2025-67499 Interim 1 1 2026-03-05T00:26:09Z current 2026-03-05T00:26:09Z 2026-03-05T00:26:09Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2025-67499 The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port. This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does not have this vulnerability. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SLES-LTSS-TERADATA 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Containers 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Containers 15 SP7 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Micro 5.5 SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise Module for Containers 15 SP6 SUSE Linux Enterprise Server 15 SP6-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Containers 15 SP7 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Module for Containers 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Containers 15 SP7 SUSE Linux Enterprise Server for SAP applications 16.0 SUSE Linux Micro 6.0 SUSE Linux Micro 6.1 openSUSE Leap 15.6 openSUSE Tumbleweed docker docker-29.2.1_ce-37.1 docker-bash-completion docker-bash-completion-29.2.1_ce-37.1 docker-buildx docker-buildx-0.31.1-37.1 docker-fish-completion docker-fish-completion-29.2.1_ce-37.1 docker-rootless-extras docker-rootless-extras-29.2.1_ce-37.1 docker-test docker-zsh-completion docker-zsh-completion-29.2.1_ce-37.1 docker-29.2.1_ce-37.1 as a component of openSUSE Tumbleweed docker-bash-completion-29.2.1_ce-37.1 as a component of openSUSE Tumbleweed docker-buildx-0.31.1-37.1 as a component of openSUSE Tumbleweed docker-fish-completion-29.2.1_ce-37.1 as a component of openSUSE Tumbleweed docker-rootless-extras-29.2.1_ce-37.1 as a component of openSUSE Tumbleweed docker-zsh-completion-29.2.1_ce-37.1 as a component of openSUSE Tumbleweed docker as a component of SLES-LTSS-TERADATA 15 SP2 docker as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS docker-bash-completion as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS docker-buildx as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS docker-fish-completion as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS docker as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS docker-bash-completion as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS docker-buildx as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS docker-rootless-extras as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS docker as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS docker-bash-completion as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS docker-buildx as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS docker-rootless-extras as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS docker as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS docker-bash-completion as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS docker-buildx as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS docker-rootless-extras as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS docker as a component of SUSE Linux Enterprise Micro 5.2 docker-buildx as a component of SUSE Linux Enterprise Micro 5.2 docker as a component of SUSE Linux Enterprise Micro 5.3 docker-buildx as a component of SUSE Linux Enterprise Micro 5.3 docker as a component of SUSE Linux Enterprise Micro 5.4 docker-buildx as a component of SUSE Linux Enterprise Micro 5.4 docker as a component of SUSE Linux Enterprise Micro 5.5 docker-buildx as a component of SUSE Linux Enterprise Micro 5.5 docker as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 docker-buildx as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 docker as a component of SUSE Linux Enterprise Module for Containers 15 SP6 docker-bash-completion as a component of SUSE Linux Enterprise Module for Containers 15 SP6 docker-buildx as a component of SUSE Linux Enterprise Module for Containers 15 SP6 docker-rootless-extras as a component of SUSE Linux Enterprise Module for Containers 15 SP6 docker-zsh-completion as a component of SUSE Linux Enterprise Module for Containers 15 SP6 docker-bash-completion as a component of SUSE Linux Enterprise Module for Containers 15 SP7 docker-rootless-extras as a component of SUSE Linux Enterprise Module for Containers 15 SP7 docker-zsh-completion as a component of SUSE Linux Enterprise Module for Containers 15 SP7 docker as a component of SUSE Linux Enterprise Module for Containers 15 SP7 docker as a component of SUSE Linux Enterprise Server 12 SP5-LTSS docker-bash-completion as a component of SUSE Linux Enterprise Server 12 SP5-LTSS docker-buildx as a component of SUSE Linux Enterprise Server 12 SP5-LTSS docker as a component of SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security docker as a component of SUSE Linux Enterprise Server 15 SP1-LTSS docker-bash-completion as a component of SUSE Linux Enterprise Server 15 SP1-LTSS docker as a component of SUSE Linux Enterprise Server 15 SP2-LTSS docker-bash-completion as a component of SUSE Linux Enterprise Server 15 SP2-LTSS docker-buildx as a component of SUSE Linux Enterprise Server 15 SP2-LTSS docker as a component of SUSE Linux Enterprise Server 15 SP3-LTSS docker-bash-completion as a component of SUSE Linux Enterprise Server 15 SP3-LTSS docker-buildx as a component of SUSE Linux Enterprise Server 15 SP3-LTSS docker-fish-completion as a component of SUSE Linux Enterprise Server 15 SP3-LTSS docker as a component of SUSE Linux Enterprise Server 15 SP4-LTSS docker-bash-completion as a component of SUSE Linux Enterprise Server 15 SP4-LTSS docker-buildx as a component of SUSE Linux Enterprise Server 15 SP4-LTSS docker-rootless-extras as a component of SUSE Linux Enterprise Server 15 SP4-LTSS docker as a component of SUSE Linux Enterprise Server 15 SP5-LTSS docker-bash-completion as a component of SUSE Linux Enterprise Server 15 SP5-LTSS docker-buildx as a component of SUSE Linux Enterprise Server 15 SP5-LTSS docker-rootless-extras as a component of SUSE Linux Enterprise Server 15 SP5-LTSS docker as a component of SUSE Linux Enterprise Server 15 SP6-LTSS docker-bash-completion as a component of SUSE Linux Enterprise Server 15 SP6-LTSS docker-buildx as a component of SUSE Linux Enterprise Server 15 SP6-LTSS docker-rootless-extras as a component of SUSE Linux Enterprise Server 15 SP6-LTSS docker-zsh-completion as a component of SUSE Linux Enterprise Server 15 SP6-LTSS docker as a component of SUSE Linux Enterprise Server 15-LTSS docker-bash-completion as a component of SUSE Linux Enterprise Server 15-LTSS docker as a component of SUSE Linux Enterprise Server 16.0 docker-bash-completion as a component of SUSE Linux Enterprise Server 16.0 docker-buildx as a component of SUSE Linux Enterprise Server 16.0 docker-fish-completion as a component of SUSE Linux Enterprise Server 16.0 docker-rootless-extras as a component of SUSE Linux Enterprise Server 16.0 docker-zsh-completion as a component of SUSE Linux Enterprise Server 16.0 docker as a component of SUSE Linux Enterprise Server Teradata 15 SP4 docker as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 docker-bash-completion as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 docker-buildx as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 docker-fish-completion as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 docker as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 docker-bash-completion as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 docker-buildx as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 docker-rootless-extras as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 docker as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 docker-bash-completion as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 docker-buildx as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 docker-rootless-extras as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 docker as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 docker-bash-completion as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 docker-buildx as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 docker-rootless-extras as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 docker-zsh-completion as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 docker as a component of SUSE Linux Enterprise Server for SAP applications 16.0 docker-bash-completion as a component of SUSE Linux Enterprise Server for SAP applications 16.0 docker-buildx as a component of SUSE Linux Enterprise Server for SAP applications 16.0 docker-fish-completion as a component of SUSE Linux Enterprise Server for SAP applications 16.0 docker-rootless-extras as a component of SUSE Linux Enterprise Server for SAP applications 16.0 docker-zsh-completion as a component of SUSE Linux Enterprise Server for SAP applications 16.0 docker as a component of SUSE Linux Micro 6.0 docker-buildx as a component of SUSE Linux Micro 6.0 docker as a component of SUSE Linux Micro 6.1 docker-buildx as a component of SUSE Linux Micro 6.1 docker as a component of openSUSE Leap 15.6 docker-bash-completion as a component of openSUSE Leap 15.6 docker-buildx as a component of openSUSE Leap 15.6 docker-fish-completion as a component of openSUSE Leap 15.6 docker-rootless-extras as a component of openSUSE Leap 15.6 docker-test as a component of openSUSE Leap 15.6 docker-zsh-completion as a component of openSUSE Leap 15.6 The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port. This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does not have this vulnerability. CVE-2025-67499 openSUSE Tumbleweed:docker-29.2.1_ce-37.1 openSUSE Tumbleweed:docker-bash-completion-29.2.1_ce-37.1 openSUSE Tumbleweed:docker-buildx-0.31.1-37.1 openSUSE Tumbleweed:docker-fish-completion-29.2.1_ce-37.1 openSUSE Tumbleweed:docker-rootless-extras-29.2.1_ce-37.1 openSUSE Tumbleweed:docker-zsh-completion-29.2.1_ce-37.1 SLES-LTSS-TERADATA 15 SP2:docker SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:docker SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:docker-bash-completion SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:docker-buildx SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:docker-fish-completion SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:docker SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:docker-bash-completion SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:docker-buildx SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:docker-rootless-extras SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:docker SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:docker-bash-completion SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:docker-buildx SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:docker-rootless-extras SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:docker SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:docker-bash-completion SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:docker-buildx SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:docker-rootless-extras SUSE Linux Enterprise Micro 5.2:docker SUSE Linux Enterprise Micro 5.2:docker-buildx SUSE Linux Enterprise Micro 5.3:docker SUSE Linux Enterprise Micro 5.3:docker-buildx SUSE Linux Enterprise Micro 5.4:docker SUSE Linux Enterprise Micro 5.4:docker-buildx SUSE Linux Enterprise Micro 5.5:docker SUSE Linux Enterprise Micro 5.5:docker-buildx SUSE Linux Enterprise Module for Basesystem 15 SP7:docker SUSE Linux Enterprise Module for Basesystem 15 SP7:docker-buildx SUSE Linux Enterprise Module for Containers 15 SP6:docker SUSE Linux Enterprise Module for Containers 15 SP6:docker-bash-completion SUSE Linux Enterprise Module for Containers 15 SP6:docker-buildx SUSE Linux Enterprise Module for Containers 15 SP6:docker-rootless-extras SUSE Linux Enterprise Module for Containers 15 SP6:docker-zsh-completion SUSE Linux Enterprise Module for Containers 15 SP7:docker SUSE Linux Enterprise Module for Containers 15 SP7:docker-bash-completion SUSE Linux Enterprise Module for Containers 15 SP7:docker-rootless-extras SUSE Linux Enterprise Module for Containers 15 SP7:docker-zsh-completion SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security:docker SUSE Linux Enterprise Server 12 SP5-LTSS:docker SUSE Linux Enterprise Server 12 SP5-LTSS:docker-bash-completion SUSE Linux Enterprise Server 12 SP5-LTSS:docker-buildx SUSE Linux Enterprise Server 15 SP1-LTSS:docker SUSE Linux Enterprise Server 15 SP1-LTSS:docker-bash-completion SUSE Linux Enterprise Server 15 SP2-LTSS:docker SUSE Linux Enterprise Server 15 SP2-LTSS:docker-bash-completion SUSE Linux Enterprise Server 15 SP2-LTSS:docker-buildx SUSE Linux Enterprise Server 15 SP3-LTSS:docker SUSE Linux Enterprise Server 15 SP3-LTSS:docker-bash-completion SUSE Linux Enterprise Server 15 SP3-LTSS:docker-buildx SUSE Linux Enterprise Server 15 SP3-LTSS:docker-fish-completion SUSE Linux Enterprise Server 15 SP4-LTSS:docker SUSE Linux Enterprise Server 15 SP4-LTSS:docker-bash-completion SUSE Linux Enterprise Server 15 SP4-LTSS:docker-buildx SUSE Linux Enterprise Server 15 SP4-LTSS:docker-rootless-extras SUSE Linux Enterprise Server 15 SP5-LTSS:docker SUSE Linux Enterprise Server 15 SP5-LTSS:docker-bash-completion SUSE Linux Enterprise Server 15 SP5-LTSS:docker-buildx SUSE Linux Enterprise Server 15 SP5-LTSS:docker-rootless-extras SUSE Linux Enterprise Server 15 SP6-LTSS:docker SUSE Linux Enterprise Server 15 SP6-LTSS:docker-bash-completion SUSE Linux Enterprise Server 15 SP6-LTSS:docker-buildx SUSE Linux Enterprise Server 15 SP6-LTSS:docker-rootless-extras SUSE Linux Enterprise Server 15 SP6-LTSS:docker-zsh-completion SUSE Linux Enterprise Server 15-LTSS:docker SUSE Linux Enterprise Server 15-LTSS:docker-bash-completion SUSE Linux Enterprise Server 16.0:docker SUSE Linux Enterprise Server 16.0:docker-bash-completion SUSE Linux Enterprise Server 16.0:docker-buildx SUSE Linux Enterprise Server 16.0:docker-fish-completion SUSE Linux Enterprise Server 16.0:docker-rootless-extras SUSE Linux Enterprise Server 16.0:docker-zsh-completion SUSE Linux Enterprise Server Teradata 15 SP4:docker SUSE Linux Enterprise Server for SAP Applications 15 SP3:docker SUSE Linux Enterprise Server for SAP Applications 15 SP3:docker-bash-completion SUSE Linux Enterprise Server for SAP Applications 15 SP3:docker-buildx SUSE Linux Enterprise Server for SAP Applications 15 SP3:docker-fish-completion SUSE Linux Enterprise Server for SAP Applications 15 SP4:docker SUSE Linux Enterprise Server for SAP Applications 15 SP4:docker-bash-completion SUSE Linux Enterprise Server for SAP Applications 15 SP4:docker-buildx SUSE Linux Enterprise Server for SAP Applications 15 SP4:docker-rootless-extras SUSE Linux Enterprise Server for SAP Applications 15 SP5:docker SUSE Linux Enterprise Server for SAP Applications 15 SP5:docker-bash-completion SUSE Linux Enterprise Server for SAP Applications 15 SP5:docker-buildx SUSE Linux Enterprise Server for SAP Applications 15 SP5:docker-rootless-extras SUSE Linux Enterprise Server for SAP Applications 15 SP6:docker SUSE Linux Enterprise Server for SAP Applications 15 SP6:docker-bash-completion SUSE Linux Enterprise Server for SAP Applications 15 SP6:docker-buildx SUSE Linux Enterprise Server for SAP Applications 15 SP6:docker-rootless-extras SUSE Linux Enterprise Server for SAP Applications 15 SP6:docker-zsh-completion SUSE Linux Enterprise Server for SAP applications 16.0:docker SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion SUSE Linux Micro 6.0:docker SUSE Linux Micro 6.0:docker-buildx SUSE Linux Micro 6.1:docker SUSE Linux Micro 6.1:docker-buildx openSUSE Leap 15.6:docker openSUSE Leap 15.6:docker-bash-completion openSUSE Leap 15.6:docker-buildx openSUSE Leap 15.6:docker-fish-completion openSUSE Leap 15.6:docker-rootless-extras openSUSE Leap 15.6:docker-test openSUSE Leap 15.6:docker-zsh-completion moderate 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H