CVE-2023-27594
Gravedad CVSS v3.1:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
17/03/2023
Última modificación:
07/11/2023
Descripción
*** Pendiente de traducción *** Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, under specific conditions, Cilium may misattribute the source IP address of traffic to a cluster, identifying external traffic as coming from the host on which Cilium is running. As a consequence, network policies for that cluster might be bypassed, depending on the specific network policies enabled.<br />
<br />
This issue only manifests when Cilium is routing IPv6 traffic and NodePorts are used to route traffic to pods. IPv6 and endpoint routes are both disabled by default.<br />
<br />
The problem has been fixed and is available on versions 1.11.15, 1.12.8, and 1.13.1. As a workaround, disable IPv6 routing.
Impacto
Puntuación base 3.x
7.30
Gravedad 3.x
ALTA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:* | 1.11.15 (excluyendo) | |
| cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:* | 1.12.0 (incluyendo) | 1.12.8 (excluyendo) |
| cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:* | 1.13.0 (incluyendo) | 1.13.1 (excluyendo) |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página