Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update module github.com/cilium/cilium to v1.15.10 [security] (v1.2) #3028

Merged
merged 1 commit into from
Oct 22, 2024
Merged

fix(deps): update module github.com/cilium/cilium to v1.15.10 [security] (v1.2) #3028

merged 1 commit into from
Oct 22, 2024

Conversation

cilium-renovate[bot]
Copy link
Contributor

This PR contains the following updates:

Package Type Update Change
github.com/cilium/cilium require patch v1.15.8 -> v1.15.10

Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present

CVE-2024-47825 / GHSA-3wwx-63fv-pfq6

More information

Details

Impact

A policy rule denying a prefix that is broader than /32 may be ignored if there is

  • A policy rule referencing a more narrow prefix (CIDRSet or toFQDN) and
  • This narrower policy rule specifies either enableDefaultDeny: false or - toEntities: all

Note that a rule specifying toEntities: world or toEntities: 0.0.0.0/0 is insufficient, it must be to entity all.

As an example, given the below policies, traffic is allowed to 1.1.1.2, when it should be denied:

apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: block-scary-range
spec:
  endpointSelector: {}
  egressDeny:
  - toCIDRSet:
    - cidr: 1.0.0.0/8

---

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: evade-deny
spec:
  endpointSelector: {}
  egress:
  - toCIDR:
    - 1.1.1.2/32
  - toEntities:
    - all
Patches

This issue affects:

  • Cilium v1.14 between v1.14.0 and v1.14.15 inclusive
  • Cilium v1.15 between v1.15.0 and v1.15.9 inclusive

This issue has been patched in:

  • Cilium v1.14.16
  • Cilium v1.15.10
Workarounds

Users with policies using enableDefaultDeny: false can work around this issue by removing this configuration option and explicitly defining any allow rules required.

No workaround is available to users with egress policies that explicitly specify toEntities: all.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @​squeed, @​christarazi, and @​jrajahalme for their work in triaging and resolving this issue.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated with top priority.

Severity

  • CVSS Score: 4.0 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

cilium/cilium (github.com/cilium/cilium)

v1.15.10: 1.15.10

Compare Source

Summary of Changes

Minor Changes:

Bugfixes:

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests
cilium

quay.io/cilium/cilium:v1.15.10@​sha256:cd096a343861d48e2849b403f0c410bfbb36e64d042f0692b73b93c97d94d9bd

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.15.10@​sha256:0d8d5490fa6097d4e7539ffcec705dd25f3f992f29528d6ec999497a02cb1399

docker-plugin

quay.io/cilium/docker-plugin:v1.15.10@​sha256:2cb1f30f87c29d5f98b7a59f743c40a1474d2b1e615153a6799a92389d1aa074

hubble-relay

quay.io/cilium/hubble-relay:v1.15.10@​sha256:d4378eb133a6bdf39f50d874b59b72f95d0da2e78bd545b3c053f3c479f593b2

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.15.10@​sha256:c78ac42e043f9e77172250a1b6997bbcd8356bb8fe7a4784deaea049207ceb9f

operator-aws

quay.io/cilium/operator-aws:v1.15.10@​sha256:c1af1bae559cd0dd9a1867a4ede95f1fef07e3de173b2b82638ebd7d91256ea0

operator-azure

quay.io/cilium/operator-azure:v1.15.10@​sha256:6cd04b35320824a50b43aa5d7fbfa6d11826f6c5ec8e4853da04a28aa3531695

operator-generic

quay.io/cilium/operator-generic:v1.15.10@​sha256:2f49dca6f9692e317601ae8b5bad7d2dc50cedad38cc8d410db14c1fc57719e4

operator

quay.io/cilium/operator:v1.15.10@​sha256:d1c10ea451c3b3d6cd62984fa653974482ffe8e083497f4e4b011d8ab5dbe964

v1.15.9: 1.15.9

Compare Source

We are happy to release Cilium v1.15.9!

This release brings us upstream filter chains for L7 LB policy enforcement, BGP (and other!) bugfixes, CI changes and many many more!

Check out the summary below for details.

Summary of Changes

Minor Changes:

Bugfixes:

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests
cilium

quay.io/cilium/cilium:v1.15.9@​sha256:c2a4c57a6baf758e975fbefbf638476906d1bb0c970e9547d216d9ea7b6471e3

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.15.9@​sha256:ec82fb96dd0fbac4c6de333aaf8f7964a74c2194a3afdf765b3c260433a4aeed

docker-plugin

quay.io/cilium/docker-plugin:v1.15.9@​sha256:1a86463fd5b38b5930069045af141ee577ead4c26f8ba4d4a532d1aa3f38a709

hubble-relay

quay.io/cilium/hubble-relay:v1.15.9@​sha256:421afd9f4e46a7b9834f0542ceca6e8652ec0598982126dc2dd1dcf0dd690631

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.15.9@​sha256:9fe2c3c6d49d4f501067ec525a3d792da17d055ebcefa37f4fbb5698109d217b

operator-aws

quay.io/cilium/operator-aws:v1.15.9@​sha256:8c2b4a4d4d6ebf1c37a6ae72da2279286729a4982bf124d98f4bcc2db5eeb5e6

operator-azure

quay.io/cilium/operator-azure:v1.15.9@​sha256:9b02e12c56b08d50eb1540d6cbb1119eee639a9795c752c4904311d03889d7fe

operator-generic

quay.io/cilium/operator-generic:v1.15.9@​sha256:0ec30b4df0d097aedcbcb41748f10ce397f9656c128bea7e227b6bfd820f6d76

operator

quay.io/cilium/operator:v1.15.9@​sha256:9ed87c339762c5b5422bd284e9672f6fedcee2aba376a5aa1328223c39bd9914

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@cilium-renovate
fix(deps): update module github.com/cilium/cilium to v1.15.10 [security]
46f1bf7 
Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com>
@cilium-renovate cilium-renovate bot requested a review from a team as a code owner October 22, 2024 09:17
@cilium-renovate cilium-renovate bot removed the request for review from a team October 22, 2024 09:17
@cilium-renovate cilium-renovate bot added the release-blocker This PR or issue is blocking the next release. label Oct 22, 2024
@cilium-renovate cilium-renovate bot added the release-note/dependency This PR updates one or multiple dependencies label Oct 22, 2024
@mtardy mtardy merged commit 855c6d4 into v1.2 Oct 22, 2024
39 checks passed
@mtardy mtardy deleted the renovate/v1.2-go-github.com-cilium-cilium-vulnerability branch October 22, 2024 15:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mtardy mtardy mtardy approved these changes

@tpapagian tpapagian Awaiting requested review from tpapagian tpapagian is a code owner automatically assigned from cilium/tetragon

Assignees
No one assigned
Labels
release-blocker This PR or issue is blocking the next release. release-note/dependency This PR updates one or multiple dependencies
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@mtardy