| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| github.com/cilium/cilium | ≥ 1.18.0, < 1.18.8≥ 1.19.0, < 1.19.2< 1.17.14 | 1.18.81.19.21.17.14 |
| cilium | ≥ 1.18.0, < 1.18.8≥ 1.19.0, < 1.19.2< 1.17.14 | 1.18.81.19.21.17.14 |
When Cilium L7 functionality is enabled on a cluster, the Envoy instance supporting this functionality creates a world-accessible socket on cluster nodes. A local attacker would be able to access Envoy admin endpoints. Depending on deployment configuration, this can expose sensitive information or allow disruptive administrative operations, such as:
This issue affects both the embedded and standalone Envoy deployment models.
This issue affects:
This issue has been patched in https://github.com/cilium/cilium/pull/44512, included in:
There is no known workaround to this issue.
The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to moemen for reporting the issue and 0xch4z for their work on triaging and remediating this issue.
If there are any questions or comments about this advisory, please reach out on [Slack (https://docs.cilium.io/en/latest/community/community/).
If anyone thinks they have found a vulnerability affecting Cilium, it is strongly encouraged to report it to the security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and the report will be treated as a top priority.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí