| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/cilium/cilium | ≥ 1.19.0, < 1.19.5 | 1.19.5 |
| cilium | ≥ 1.19.0, < 1.19.5 | 1.19.5 |
Standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule under specific cluster configurations.
When Cilium deployment is configured with a specific custom clusterName (rather than the default "any" value), the parser incorrectly instantiates a pod selector on selectorless peer definitions. This leads to Cilium appending an unintended wildcard namespace label selector to the policy's allowed Layer 3 rules, which allows traffic from other workloads in the same namespace as the subject of the policy.
Example policy affected by this issue:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: test-server
namespace: default
spec:
podSelector:
matchLabels:
app: test-server
policyTypes:
- Ingress
ingress:
- from:
- ipBlock:
cidr: 192.0.2.3
In affected versions, this policy erroneously allows the test-server Pod in the default namespace to receive any traffic from other workloads running in the default namespace.
This issue has been patched in:
Releases below v1.19.0 are not affected.
Developers can create the equivalent policy using CiliumNetworkPolicy fromCIDR expressions. CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy are not affected by this issue.
Special thanks to @TheBeeZee for reporting this issue and preparing the fix, and to @fristonio and @odinuge for their assistance in reviewing the solution.
If a vulnerability affecting Cilium appears to have been found, the Cilium security team strongly encourages reporting it to the security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and the report will be treated as top priority.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free