PT-2023-21573 · Etcd+1 · Etcd+1

Giorio94 · Published 2023-03-21 · Updated 2024-08-20 · CVE-2023-28114

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions cilium-cli versions prior to 0.13.2

Description The issue arises when cilium-cli is used to configure cluster mesh functionality, potentially removing the enforcement of user permissions on the etcd store. This occurs due to an incorrect mount point specification, causing the settings specified by the initContainer to be overwritten. As a result, an attacker with access to a valid key and certificate for the compromised etcd cluster could modify its state.

Recommendations For versions prior to 0.13.2, update to version 0.13.2 to resolve the issue. As a temporary workaround, consider using Cilium's Helm charts to create the cluster instead of cilium-cli.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-280

Related Identifiers

CVE-2023-28114

GHSA-6F27-3P6C-P5JC

GO-2023-1653

Affected Products

Cilium-Cli

Etcd

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28114.json · Exploit
• https://github.com/cilium/cilium-cli/security/advisories/GHSA-6f27-3p6c-p5jc · Vendor Advisory
• https://github.com/cilium/cilium-cli/commit/fb1427025764e1eebc4a7710d902c4f22cae2610 · Patch
• https://osv.dev/vulnerability/CVE-2023-28114 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28114 · Security Note
• https://osv.dev/vulnerability/GHSA-6f27-3p6c-p5jc · Vendor Advisory
• https://github.com/cilium/cilium-cli · Note
• https://github.com/cilium/cilium-cli/releases/tag/v0.13.2 · Note
• https://t.me/cvenotify/46689 · Telegram Post
• https://artifacthub.io/packages/helm/cilium/cilium · Note