PT-2023-21573 · Etcd+1 · Etcd+1

Giorio94 · Publicado 2023-03-21 · Atualizado 2024-08-20 · CVE-2023-28114

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions cilium-cli versions prior to 0.13.2

Description The issue arises when cilium-cli is used to configure cluster mesh functionality, potentially removing the enforcement of user permissions on the etcd store. This occurs due to an incorrect mount point specification, causing the settings specified by the initContainer to be overwritten. As a result, an attacker with access to a valid key and certificate for the compromised etcd cluster could modify its state.

Recommendations For versions prior to 0.13.2, update to version 0.13.2 to resolve the issue. As a temporary workaround, consider using Cilium's Helm charts to create the cluster instead of cilium-cli.

Exploit

Correção

Improper Handling of Exceptional Conditions

Enumeração de Fraquezas

CWE-755

CWE-280

Identificadores relacionados

CVE-2023-28114

GHSA-6F27-3P6C-P5JC

GO-2023-1653

Produtos afetados

Cilium-Cli

Etcd

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28114.json · Exploit
• https://github.com/cilium/cilium-cli · Nota
• https://github.com/cilium/cilium-cli/releases/tag/v0.13.2 · Nota
• https://github.com/cilium/cilium-cli/security/advisories/GHSA-6f27-3p6c-p5jc · Aviso do Fabricante
• https://github.com/cilium/cilium-cli/commit/fb1427025764e1eebc4a7710d902c4f22cae2610 · Correção
• https://osv.dev/vulnerability/CVE-2023-28114 · Aviso do Fabricante
• https://t.me/cvenotify/46689 · Publicação no Telegram
• https://osv.dev/vulnerability/GO-2023-1653 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-28114 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-6f27-3p6c-p5jc · Aviso do Fabricante
• https://artifacthub.io/packages/helm/cilium/cilium · Nota