x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2023-41332

[GoVulnBot]

CVE-2023-41332 references github.com/cilium/cilium, which may be a Go module.

Description:
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with policy.cilium.io/proxy-visibility annotations (in Cilium >= v1.13) or io.cilium.proxy-visibility annotations (in Cilium <= v1.12) causes the Cilium agent to segfault on the node to which the workload is assigned. Existing traffic on the affected node will continue to flow, but the Cilium agent on the node will not able to process changes to workloads running on the node. This will also prevent workloads from being able to start on the affected node. The denial of service will be limited to the node on which the workload is scheduled, however an attacker may be able to schedule workloads on the node of their choosing, which could lead to targeted attacks. This issue has been resolved in Cilium versions 1.14.2, 1.13.7, and 1.12.14. Users unable to upgrade can avoid this denial of service attack by enabling the Layer 7 proxy.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-41332
• JSON: https://github.com/CVEProject/cvelist/tree/8e23c01bc8ca16079613b67ffe67860eec01624b/2023/41xxx/CVE-2023-41332.json
• advisory: GHSA-24m5-r6hv-ccgp
• fix: proxy: Ignore visibility annotation if proxy is disabled cilium/cilium#27597
• Imported by: https://pkg.go.dev/github.com/cilium/cilium?tab=importedby

Cross references:

• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-c66w-hq56-4q97 #393 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2022-29178 #457 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2022-29179 #458 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-wc5v-r48v-g4vh #530 NOT_GO_CODE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-pfhr-pccp-hwmh #959 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-4hc4-pgfx-3mrx #1642 NOT_GO_CODE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-8fg8-jh2h-f2hc #1643 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-r5x6-w42p-jhpp #1644 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2023-29002 #1730 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-2h44-x2wx-49f4 #1785 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2023-34242 #1862 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/cilium/cilium
      vulnerable_at: 1.14.2
      packages:
        - package: cilium
description: |-
    Cilium is a networking, observability, and security solution with an eBPF-based
    dataplane. In Cilium clusters where Cilium's Layer 7 proxy has been disabled,
    creating workloads with `policy.cilium.io/proxy-visibility` annotations (in
    Cilium >= v1.13) or `io.cilium.proxy-visibility` annotations (in Cilium <=
    v1.12) causes the Cilium agent to segfault on the node to which the workload is
    assigned. Existing traffic on the affected node will continue to flow, but the
    Cilium agent on the node will not able to process changes to workloads running
    on the node. This will also prevent workloads from being able to start on the
    affected node. The denial of service will be limited to the node on which the
    workload is scheduled, however an attacker may be able to schedule workloads on
    the node of their choosing, which could lead to targeted attacks. This issue has
    been resolved in Cilium versions 1.14.2, 1.13.7, and 1.12.14. Users unable to
    upgrade can avoid this denial of service attack by enabling the Layer 7 proxy.
cves:
    - CVE-2023-41332
references:
    - advisory: https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp
    - fix: https://github.com/cilium/cilium/pull/27597

[jba]

Vulnerability in tool.

[gopherbot]

Change https://go.dev/cl/531705 mentions this issue: data/excluded: batch add 18 excluded reports

[jba]

Duplicate of #2079