PT-2023-27910 · Cilium · Cilium
Odinuge
·
Publicado
2023-09-26
·
Atualizado
2024-08-21
·
CVE-2023-41333
CVSS v3.1
6.9
Média
| Vetor | AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Cilium versions prior to 1.14.2
Cilium versions prior to 1.13.7
Cilium versions prior to 1.12.14
Description
An attacker with the ability to create or modify CiliumNetworkPolicy objects in a particular namespace can affect traffic on an entire Cilium cluster, potentially bypassing policy enforcement in other namespaces. By using a crafted
endpointSelector that uses the DoesNotExist operator on the reserved:init label, the attacker can create policies that bypass namespace restrictions and affect the entire Cilium cluster, including potentially allowing or denying all traffic. This attack requires API server access.Recommendations
For versions prior to 1.14.2, update to version 1.14.2 or later.
For versions prior to 1.13.7, update to version 1.13.7 or later.
For versions prior to 1.12.14, update to version 1.12.14 or later.
As a temporary workaround, consider using an admission webhook to prevent the use of
endpointSelectors that use the DoesNotExist operator on the reserved:init label in CiliumNetworkPolicies.Exploit
Correção
Missing Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cilium