CVE-2023-30851

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.

CVSS v3 2.6 LOW

2.6^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.0 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/cilium/cilium/releases/tag/v1.11.16	Release Notes
https://github.com/cilium/cilium/releases/tag/v1.12.9	Release Notes
https://github.com/cilium/cilium/releases/tag/v1.13.2	Release Notes
https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4	Vendor Advisory
https://github.com/cilium/cilium/releases/tag/v1.11.16	Release Notes
https://github.com/cilium/cilium/releases/tag/v1.12.9	Release Notes
https://github.com/cilium/cilium/releases/tag/v1.13.2	Release Notes
https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cilium:cilium::::::::
	cpe:2.3:a:cilium:cilium::::::::
	cpe:2.3:a:cilium:cilium::::::::

History

No history.

Information

Published : 2023-05-25 18:15

Updated : 2024-11-21 08:00

NVD link : CVE-2023-30851

Mitre link : CVE-2023-30851

CVE.ORG link : CVE-2023-30851

JSON object : View

Products Affected

cilium

cilium

CWE

CWE-693

Protection Mechanism Failure

NVD-CWE-noinfo

{"id": "CVE-2023-30851", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 2.6, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "published": "2023-05-25T18:15:10.240", "references": [{"url": "https://github.com/cilium/cilium/releases/tag/v1.11.16", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cilium/cilium/releases/tag/v1.12.9", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cilium/cilium/releases/tag/v1.13.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cilium/cilium/releases/tag/v1.11.16", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/cilium/cilium/releases/tag/v1.12.9", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/cilium/cilium/releases/tag/v1.13.2", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-693"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2."}], "lastModified": "2024-11-21T08:00:58.323", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "826FEF2C-9172-44D8-AE4C-B656329510F2", "versionEndExcluding": "1.11.16"}, {"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8371AD7-2C69-4584-B0C3-2AB4E632FC37", "versionEndExcluding": "1.12.9", "versionStartIncluding": "1.12.0"}, {"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2A8D7A6-200B-443C-B171-512964293B8D", "versionEndExcluding": "1.13.2", "versionStartIncluding": "1.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}