Cilium · Cilium · CVE-2023-41332
**Name of the Vulnerable Software and Affected Versions**
Cilium versions prior to 1.14.2
Cilium versions prior to 1.13.7
Cilium versions prior to 1.12.14
**Description**
In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with `policy.cilium.io/proxy-visibility` annotations or `io.cilium.proxy-visibility` annotations causes the Cilium agent to segfault on the node to which the workload is assigned. Existing traffic on the affected node will continue to flow, but the Cilium agent on the node will not be able to process changes to workloads running on the node. This will also prevent workloads from being able to start on the affected node. The denial of service will be limited to the node on which the workload is scheduled, however an attacker may be able to schedule workloads on the node of their choosing, which could lead to targeted attacks.
**Recommendations**
For Cilium versions prior to 1.14.2, update to version 1.14.2 or later.
For Cilium versions prior to 1.13.7, update to version 1.13.7 or later.
For Cilium versions prior to 1.12.14, update to version 1.12.14 or later.
As a temporary workaround, consider enabling the Layer 7 proxy to avoid this denial of service attack.