CVE-2022-29178: Vulnerability in hubble-ui-backend package
Summary
CVE-2022-29178: Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Affects hubble-ui-backend across 3 version ranges.
< 1.9.16
>= 1.10.0, < 1.10.11
>= 1.11.0, < 1.11.5
Fixed in 1.9.16, 1.10.11 or 1.11.5, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/cilium/cilium · Go
- hubble-ui · Bitnami
- cilium-proxy · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2022-29178 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hubble-ui-backend package is a component of Bitnami's Hubble UI, an open source software used for providing and securing network connectivity and load balancing between application workloads. It is designed to enhance network visibility and security in Kubernetes environments. The package allows users belonging to the group ID 1000 to access the API of Cilium, a network connectivity and security software, via a Unix domain socket. This vulnerability affects versions prior to 1.9.16, 1.10.11, and 1.11.5 of Cilium.
Vulnerability Detail
The vulnerability arises from an incorrect default permissions setting in Cilium. It allows malicious users with access to the Unix domain socket on the host where Cilium is running to compromise the integrity and availability of the system. This can lead to unauthorized access, data breaches, and disruption of services. The issue has been addressed in versions 1.9.16, 1.10.11, and 1.11.5 of Cilium.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.9.161.9.16 -
>= 1.10.0, < 1.10.111.10.11 -
>= 1.11.0, < 1.11.51.11.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A potential workaround is to modify Cilium's DaemonSet to run with a certain command. The specific command can be found in the GitHub Security Advisory for this vulnerability. However, applying the fix by updating to the fixed versions is the recommended approach.
Conclusion
The vulnerability in the hubble-ui-backend package allows unauthorized access to the Cilium API via a Unix domain socket, potentially compromising system integrity and availability. It is crucial to update the package to one of the fixed versions to mitigate the risk of exploitation.
See every vulnerability recorded for hubble-ui-backend →
FAQ
Hubble UI is an open source software used for providing and securing network connectivity and load balancing between application workloads in Kubernetes environments. The hubble-ui-backend package is a component of Hubble UI.
Cilium is an open source software that provides network connectivity and security for applications running in Kubernetes environments. It is used by hubble-ui-backend for its network functionality.
Users of hubble-ui-backend versions prior to 1.9.16, 1.10.11, and 1.11.5 are affected by this vulnerability.
An attacker with access to the Unix domain socket on the host where Cilium is running can compromise the integrity and availability of the system. This can lead to unauthorized access, data breaches, and disruption of services.
To fix this vulnerability, update the hubble-ui-backend package to one of the fixed versions: 1.9.16, 1.10.11, or 1.11.5.
References
Related vulnerabilities
Recent vulnerabilities recorded for hubble-ui-backend.
