CVE-2023-27594: Vulnerability in hubble-ui-backend package
Summary
CVE-2023-27594: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Affects hubble-ui-backend across 3 version ranges.
< 1.11.15
>= 1.12.0, < 1.12.8
>= 1.13.0, < 1.13.1
Fixed in 1.11.15, 1.12.8 or 1.13.1, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/cilium/cilium · Go
- hubble-ui · Bitnami
- cilium-proxy · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2023-27594 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hubble-ui-backend package is a component of Bitnami's Hubble UI, which is a networking, observability, and security solution. It provides a user interface for managing and monitoring network policies in a cluster. The package is susceptible to a specific vulnerability that can lead to misattribution of the source IP address of traffic, potentially bypassing network policies.
Vulnerability Detail
Under certain conditions, the hubble-ui-backend package may misattribute the source IP address of traffic to a cluster, incorrectly identifying external traffic as originating from the host on which the package is running. This can result in the bypassing of network policies for that cluster, depending on the specific policies enabled. The issue only occurs when routing IPv6 traffic and using NodePorts to route traffic to pods. IPv6 routing is disabled by default. The vulnerability has been addressed in versions 1.11.15, 1.12.8, and 1.13.1 of the package. As a workaround, users can disable IPv6 routing.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.11.151.11.15 -
>= 1.12.0, < 1.12.81.12.8 -
>= 1.13.0, < 1.13.11.13.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable IPv6 routing. This can be achieved by modifying the relevant configuration settings. Detailed instructions on how to disable IPv6 routing can be found in the Bitnami documentation.
Conclusion
The hubble-ui-backend package is vulnerable to a misattribution of source IP addresses when routing IPv6 traffic with NodePorts. This can lead to the bypassing of network policies. Users should update to versions 1.11.15, 1.12.8, or 1.13.1 to fix the vulnerability. Alternatively, they can disable IPv6 routing as a temporary workaround.
See every vulnerability recorded for hubble-ui-backend →
FAQ
The hubble-ui-backend package is a component of Bitnami's Hubble UI, providing a user interface for managing and monitoring network policies in a cluster.
The vulnerability can result in the misattribution of source IP addresses, potentially bypassing network policies for a cluster.
To fix the vulnerability, users should update their hubble-ui-backend package to version 1.11.15, 1.12.8, or 1.13.1.
Yes, a temporary workaround is to disable IPv6 routing. Instructions on how to do this can be found in the Bitnami documentation.
No, IPv6 routing is disabled by default.
References
Related vulnerabilities
Recent vulnerabilities recorded for hubble-ui-backend.
