{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-41332", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-08-28T16:56:43.367Z", "datePublished": "2023-09-26T20:27:41.226Z", "dateUpdated": "2024-08-02T19:01:34.337Z"}, "containers": {"cna": {"title": "Denial of service via Kubernetes annotations in specific Cilium configurations", "problemTypes": [{"descriptions": [{"cweId": "CWE-755", "lang": "en", "description": "CWE-755: Improper Handling of Exceptional Conditions", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp"}, {"name": "https://github.com/cilium/cilium/pull/27597", "tags": ["x_refsource_MISC"], "url": "https://github.com/cilium/cilium/pull/27597"}], "affected": [{"vendor": "cilium", "product": "cilium", "versions": [{"version": ">= 1.14.0, < 1.14.2", "status": "affected"}, {"version": ">= 1.13.0, < 1.13.7", "status": "affected"}, {"version": "< 1.12.14", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-09-26T20:27:41.226Z"}, "descriptions": [{"lang": "en", "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with `policy.cilium.io/proxy-visibility` annotations (in Cilium >= v1.13) or `io.cilium.proxy-visibility` annotations (in Cilium <= v1.12) causes the Cilium agent to segfault on the node to which the workload is assigned. Existing traffic on the affected node will continue to flow, but the Cilium agent on the node will not able to process changes to workloads running on the node. This will also prevent workloads from being able to start on the affected node. The denial of service will be limited to the node on which the workload is scheduled, however an attacker may be able to schedule workloads on the node of their choosing, which could lead to targeted attacks. This issue has been resolved in Cilium versions 1.14.2, 1.13.7, and 1.12.14. Users unable to upgrade can avoid this denial of service attack by enabling the Layer 7 proxy.\n\n"}], "source": {"advisory": "GHSA-24m5-r6hv-ccgp", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:01:34.337Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp"}, {"name": "https://github.com/cilium/cilium/pull/27597", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/cilium/cilium/pull/27597"}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "matchCriteriaId": "35ABDE15-4D2F-4F82-BA90-6529DBA75C4F", "versionEndExcluding": "1.12.14", "vulnerable": true}, {"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "matchCriteriaId": "FAD54EC5-459F-43CF-8C36-BB84717CD640", "versionEndExcluding": "1.13.7", "versionStartIncluding": "1.13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "matchCriteriaId": "F8854A94-3A9D-4BCD-AC5C-2D8AEF70AA40", "versionEndExcluding": "1.14.2", "versionStartIncluding": "1.14.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with `policy.cilium.io/proxy-visibility` annotations (in Cilium >= v1.13) or `io.cilium.proxy-visibility` annotations (in Cilium <= v1.12) causes the Cilium agent to segfault on the node to which the workload is assigned. Existing traffic on the affected node will continue to flow, but the Cilium agent on the node will not able to process changes to workloads running on the node. This will also prevent workloads from being able to start on the affected node. The denial of service will be limited to the node on which the workload is scheduled, however an attacker may be able to schedule workloads on the node of their choosing, which could lead to targeted attacks. This issue has been resolved in Cilium versions 1.14.2, 1.13.7, and 1.12.14. Users unable to upgrade can avoid this denial of service attack by enabling the Layer 7 proxy.\n\n"}, {"lang": "es", "value": "Cilium es una soluci\u00f3n de redes, observabilidad y seguridad con un plano de datos basado en eBPF. En los cl\u00fasteres de Cilium donde el proxy de capa 7 de Cilium se ha deshabilitado, la creaci\u00f3n de cargas de trabajo con anotaciones `policy.cilium.io/proxy-visibility` (en Cilium versiones &gt;= 1.13) o anotaciones `io.cilium.proxy-visibility` (en Cilium versiones &lt;= 1.12) hace que el agente Cilium tenga un error de segmentaci\u00f3n en el nodo al que est\u00e1 asignada la carga de trabajo. El tr\u00e1fico existente en el nodo afectado seguir\u00e1 fluyendo, pero el agente Cilium en el nodo no podr\u00e1 procesar cambios en las cargas de trabajo que se ejecutan en el nodo. Esto tambi\u00e9n evitar\u00e1 que las cargas de trabajo puedan iniciarse en el nodo afectado. La denegaci\u00f3n de servicio se limitar\u00e1 al nodo en el que est\u00e1 programada la carga de trabajo; sin embargo, un atacante puede programar cargas de trabajo en el nodo de su elecci\u00f3n, lo que podr\u00eda dar lugar a ataques dirigidos. Este problema se resolvi\u00f3 en las versiones 1.14.2, 1.13.7 y 1.12.14 de Cilium. Los usuarios que no puedan actualizar pueden evitar este ataque de denegaci\u00f3n de servicio habilitando el proxy de capa 7."}], "id": "CVE-2023-41332", "lastModified": "2023-09-29T13:56:15.203", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-09-27T15:19:30.023", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Issue Tracking", "Patch"], "url": "https://github.com/cilium/cilium/pull/27597"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Patch", "Third Party Advisory"], "url": "https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-755"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}