GHSA-w7c2-w76w-5hmj: Medium severity go/github.com/cilium/cilium vulnerability
Impact
In Cilium clusters using Gateway API, users with permissions to create or update namespaced HTTPRoutes can mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism.
Gateway API functionality is disabled by default.
Patches
This issue affects:
Cilium v1.19 from v1.19.0 to v1.19.4 inclusive Cilium v1.18 from v1.18.0 to v1.18.10 inclusive All versions of Cilium before v1.17.17
This issue is patched in:
Cilium v1.19.5 Cilium v1.18.11 Cilium v1.17.17
Workarounds
There is no workaround to this issue. Users of this feature who are unable to upgrade can mitigate the risk by ensuring that RBAC permissions to create HTTPRoute objects are only granted to cluster admins.
Acknowledgements
The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @galanko for reporting the issue and @mhofstetter for their work on triaging and remediating this issue.
For more information
If you have any questions or comments about this advisory, please reach out on Slack.
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/cilium/ciliumto a version that resolves this vulnerability.Fixed in 1.19.5 - Upgrade
Upgrade
go/github.com/cilium/ciliumCiliumto a version that resolves this vulnerability.Fixed in 1.18.11 - Upgrade
Upgrade
go/github.com/cilium/ciliumto a version that resolves this vulnerability.Fixed in 1.17.17 - Upgrade
Upgrade
Ciliumto a version that resolves this vulnerability.Fixed in v1.17.17 - Upgrade
Upgrade
Ciliumto a version that resolves this vulnerability.Fixed in v1.18.11 - Upgrade
Upgrade
Ciliumto a version that resolves this vulnerability.Fixed in v1.19.5 - Compensating control
For users unable to upgrade, ensure RBAC permissions to create HTTPRoute objects are granted only to cluster admins.
Event History
Frequently Asked Questions
Are default Cilium deployments affected?
Gateway API functionality is disabled by default. The issue applies to Cilium clusters that have enabled Gateway API.
What level of access is needed to exploit this issue?
An attacker needs permission to create or update namespaced HTTPRoute objects. That access can be used to mirror HTTP traffic to any Service in any namespace, bypassing ReferenceGrant authorization.
What can be done if an upgrade cannot be performed immediately?
There is no workaround. Mitigate risk by restricting permissions to create HTTPRoute objects to cluster administrators only.
Which versions contain the fix?
Upgrade to Cilium v1.19.5, v1.18.11, or v1.17.17, as appropriate for the release line in use.