CVE-2023-30851
Fixed in a distro release EPSS <1%CVSS 2.6
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.
Products: cilium
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/cilium/cilium | 1.11.16 |
| Go | github.com/cilium/cilium | 1.12.9 |
| Go | github.com/cilium/cilium | 1.13.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cilium-1.14 | 1.14.19-r23 |
| Chainguard | cilium-1.14-clustermesh-apiserver | 1.14.19-r23 |
| Chainguard | cilium-1.14-container-init | 1.14.19-r23 |
| Chainguard | cilium-1.14-container-init-compat | 1.14.19-r23 |
| Chainguard | cilium-1.14-hubble-relay | 1.14.19-r23 |
| Chainguard | cilium-1.14-iptables | 1.14.19-r23 |
| Chainguard | cilium-1.14-operator-aws | 1.14.19-r23 |
| Chainguard | cilium-1.14-operator-generic | 1.14.19-r23 |
| Chainguard | cilium-1.15 | 0 |
| Chainguard | cilium-1.15-clustermesh-apiserver | 0 |
| Chainguard | cilium-1.15-container-init | 0 |
| Chainguard | cilium-1.15-container-init-compat | 0 |
| Chainguard | cilium-1.15-hubble-relay | 0 |
| Chainguard | cilium-1.15-iptables | 0 |
| Chainguard | cilium-1.15-operator-aws | 0 |
| Chainguard | cilium-1.15-operator-generic | 0 |
| Chainguard | cilium-fips-1.14 | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-clustermesh-apiserver | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-compat | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-container-init | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-container-init-compat | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-host-utils | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-hubble-relay | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-iptables | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-operator-aws | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-operator-azure | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-operator-generic | 1.14.19-r24 |
| Chainguard | cilium-fips-1.15 | 0 |
| Chainguard | cilium-fips-1.15-clustermesh-apiserver | 0 |
| Chainguard | cilium-fips-1.15-container-init | 0 |
| Chainguard | cilium-fips-1.15-container-init-compat | 0 |
| Chainguard | cilium-fips-1.15-host-utils | 0 |
| Chainguard | cilium-fips-1.15-hubble-relay | 0 |
| Chainguard | cilium-fips-1.15-operator-aws | 0 |
| Chainguard | cilium-fips-1.15-operator-azure | 0 |
| Chainguard | cilium-fips-1.15-operator-generic | 0 |
| Chainguard | hubble-ui-backend | 0.12.0-r0 |
| Wolfi | cilium-1.14 | 1.14.19-r23 |
| Wolfi | cilium-1.14-container-init | 1.14.19-r23 |
| Wolfi | cilium-1.14-container-init-compat | 1.14.19-r23 |
| Wolfi | cilium-1.14-hubble-relay | 1.14.19-r23 |
| Wolfi | cilium-1.14-iptables | 1.14.19-r23 |
| Wolfi | cilium-1.14-operator-generic | 1.14.19-r23 |
| Wolfi | cilium-1.15 | 0 |
| Wolfi | cilium-1.15-container-init | 0 |
| Wolfi | cilium-1.15-container-init-compat | 0 |
| Wolfi | cilium-1.15-hubble-relay | 0 |
| Wolfi | cilium-1.15-iptables | 0 |
| Wolfi | cilium-1.15-operator-aws | 0 |
| Wolfi | cilium-1.15-operator-generic | 0 |
| Wolfi | hubble-ui-backend | 0.12.0-r0 |