CVE-2023-27594: Cilium-Proxy Misattributed Source IP Address
Summary
CVE-2023-27594: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Affects cilium-proxy across 3 version ranges.
< 1.11.15
>= 1.12.0, < 1.12.8
>= 1.13.0, < 1.13.1
Fixed in 1.11.15, 1.12.8 or 1.13.1, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/cilium/cilium · Go
- hubble-ui-backend · Bitnami
- hubble-ui · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2023-27594 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides advanced features for managing network policies and routing traffic within a cluster. Cilium-proxy is a component of Cilium that handles proxying and load balancing for network traffic. It is used in conjunction with NodePorts to route traffic to pods. Cilium-proxy is developed and maintained by Bitnami.
Vulnerability Detail
Under specific conditions, Cilium may misattribute the source IP address of traffic to a cluster, incorrectly identifying external traffic as coming from the host on which Cilium is running. This misattribution can lead to bypassing network policies for that cluster, potentially compromising the security of the system. The issue only occurs when Cilium is routing IPv6 traffic and NodePorts are used. IPv6 routing and endpoint routes are disabled by default. The vulnerability has been assigned CVE-2023-27594 and has a CVSSv3 score of 7.8 (High).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.11.151.11.15 -
>= 1.12.0, < 1.12.81.12.8 -
>= 1.13.0, < 1.13.11.13.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable IPv6 routing in Cilium. This can be achieved by modifying the Cilium configuration to ensure that IPv6 routing is explicitly disabled. Please refer to the Cilium documentation for instructions on how to disable IPv6 routing.
Conclusion
The misattribution of source IP addresses in Cilium-proxy can lead to bypassing network policies and compromising the security of the system. It is crucial to upgrade to the fixed versions of Cilium (1.11.15, 1.12.8, or 1.13.1) to ensure correct source IP attribution and proper enforcement of network policies. Additionally, disabling IPv6 routing can serve as a temporary workaround until the upgrade is performed.
See every vulnerability recorded for cilium-proxy →
FAQ
Cilium is a networking, observability, and security solution for Kubernetes clusters. It provides advanced features for managing network policies and routing traffic using eBPF-based dataplane technology.
Cilium-proxy is a component of Cilium that handles proxying and load balancing for network traffic. It is used in conjunction with NodePorts to route traffic to pods.
This vulnerability in Cilium-proxy can lead to misattribution of source IP addresses, potentially bypassing network policies and compromising the security of the system.
To fix this vulnerability, upgrade your Cilium installation to one of the fixed versions: 1.11.15, 1.12.8, or 1.13.1. These versions address the issue and ensure correct source IP attribution.
Yes, as a temporary workaround, you can disable IPv6 routing in Cilium. Please refer to the Cilium documentation for instructions on how to disable IPv6 routing.
References
Related vulnerabilities
Recent vulnerabilities recorded for cilium-proxy.
