GHSA-pg5p-wwp8-97g8 BIT-cilium-2023-29002 BIT-cilium-operator-2023-29002 BIT-cilium-proxy-2023-29002 BIT-hubble-2023-29002 BIT-hubble-relay-2023-29002 BIT-hubble-ui-2023-29002 BIT-hubble-ui-backend-2023-29002 CVE-2023-29002 GO-2023-1730
Debug mode leaks confidential data in Cilium
- Severity
- 7.2 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.20%
- Chance of exploitation in the next 30 days. Higher than 9.52% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-532 Insertion of Sensitive Information into Log File
- Fix
1.11.16- Upgrade github.com/cilium/cilium to this version or later
Description
Impact
When run in debug mode, Cilium may log sensitive information.
In particular, Cilium running in debug mode will log the values of headers if they match HTTP network policy rules. This issue affects Cilium versions:
- 1.7.* to 1.10.* inclusive
- 1.11.* before 1.11.16
- 1.12.* before 1.12.9
- 1.13.* before 1.13.2
In addition, Cilium 1.12.* before 1.12.9 and 1.13.* before 1.13.2., when running in debug mode, might log secrets used by the Cilium agent. This includes TLS private keys for Ingress and GatewayAPI resources, depending on the configuration of the affected cluster. Output of the confidential data would occur at Cilium agent restart, when the secrets are modified, and on creation of Ingress or GatewayAPI resources.
Patches
This vulnerability is fixed in Cilium releases 1.11.16, 1.12.9, and 1.13.2.
Workarounds
Disable debug mode.
Acknowledgements
The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @meyskens for investigating and fixing the issue.
For more information
If you have any questions or comments about this advisory, please reach out on Slack.
As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: security@cilium.io - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/cilium/cilium | >= 1.7.0, <= 1.10.0 |
No fix yet |
| github.com/cilium/cilium | >= 1.11.0, < 1.11.16 |
1.11.16 |
| github.com/cilium/cilium | >= 1.12.0, < 1.12.9 |
1.12.9 |
| github.com/cilium/cilium | >= 1.13.0, < 1.13.2 |
1.13.2 |
| github.com/cilium/cilium | >= 1.7.0, < 1.11.16>= 1.12.0, < 1.12.9>= 1.13.0, < 1.13.2 |
1.11.161.12.91.13.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/cilium/cilium Go → 1.11.16
- go
go get github.com/cilium/cilium@v1.11.16 && go mod tidy
Severity breakdown
CVSS 3.1 7.2
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
- Attack vector
- Local
- Attack complexity
- High
- Privileges required
- High
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
How to prevent it
- Architecture and Design, Implementation: Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
- Distribution: Remove debug log files before deploying the application into production.
- Operation: Protect log files against unauthorized read/write.
- Implementation: Adjust configurations appropriately when software is transitioned from a debug state to production.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-fm8w-2m5w-9j7r Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match | Medium | Also affects github.com/cilium/cilium |
| GHSA-w7c2-w76w-5hmj Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces | High | Also affects github.com/cilium/cilium |
| GHSA-q6h5-q3q6-f87x CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation | Medium | Also affects github.com/cilium/cilium |
| GHSA-3fcv-jvfp-m4q9 Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access | High | Also affects github.com/cilium/cilium |
| GHSA-gj49-89wh-h4gj Cillium exposes sensitive information included in the cilium-bugtool debug archive | Medium | Also affects github.com/cilium/cilium |
| GHSA-hxv8-4j4r-cqgv Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic | Medium | Also affects github.com/cilium/cilium |
| GHSA-5r23-prx4-mqg3 Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled | Medium | Also affects github.com/cilium/cilium |
| GHSA-38pp-6gcp-rqvm Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic | Medium | Also affects github.com/cilium/cilium |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor