fix(deps): update module github.com/cilium/cilium to v1.15.8 [security] (v1.1) #2810
Conversation
![cilium-renovate[bot]](https://avatars.githubusercontent.com/in/339224?s=60&v=4){kind=small}
Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com>
cilium-renovate
bot
requested review from
olsajiri
and removed request for
a team
cilium-renovate
bot
added
release-blocker
ℹ Artifact update noticeFile name: pkg/k8s/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
I guess we need cilium/little-vm-helper@5756be9, which is part of little-vm-helper v0.0.19 |
|
Pushed a patch for updating to lvh v0.0.19 🤞🏼 |
A renovate PR wants to update the docker version. update to lvh so that we can get cilium/little-vm-helper@5756be9. Signed-off-by: Kornilios Kourtis <[email protected]>
kkourt
force-pushed
the
renovate/v1.1-go-github.com-cilium-cilium-vulnerability
branch
from
1130bb8 to
52cffbd
Compare
|
We have the following failures in golangci-lint:
Since this is a stable branch, I think that's OK. |
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
Yep this is something I fixed on main, let's just ignore it there by adding a line in the linter's config. Let me push a commit there. |
Those have been fixed on the main branch, let's ignore them safely on the stable branch. Signed-off-by: Mahe Tardy <[email protected]>
mtardy
deleted the
renovate/v1.1-go-github.com-cilium-cilium-vulnerability
branch
This PR contains the following updates:
v1.15.6->v1.15.8GitHub Vulnerability Alerts
CVE-2024-42488
Impact
A race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass.
Patches
This issue was fixed in https://github.com/cilium/cilium/pull/33511.
This issue affects:
This issue has been patched in:
Workarounds
As the underlying issue depends on a race condition, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected.
Acknowledgements
The Cilium community has worked together with members of Google and Isovalent to prepare these mitigations. Special thanks to @skmatti for raising and resolving this issue.
For more information
If you have any questions or comments about this advisory, please reach out on Slack.
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
CVE-2024-42487
Impact
Gateway API HTTPRoutes and GRPCRoutes do not follow the match precedence specified in the Gateway API specification. In particular, request headers are matched before request methods, when the specification describes that the request methods must be respected before headers are matched (HTTPRouteRule, GRPCRouteRule).
If users create Gateway API resources that use both request headers and request methods in order to route to different destinations, then traffic may be delivered to the incorrect backend. If the backend does not have Network Policy restricting acceptable traffic to receive, then requests may access information that you did not intend for them to access.
Patches
This issue was fixed in https://github.com/cilium/cilium/pull/34109.
This issue affects:
This issue is fixed in:
Workarounds
There is no workaround for this issue.
Acknowledgements
The Cilium community has worked together with members of Cure53 and Isovalent to prepare these mitigations. Special thanks to @sayboras for remediating this issue.
Further information
If you have any questions or comments about this advisory, please reach out on Slack.
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
CVE-2024-42486
Impact
Due to ReferenceGrant changes not being immediately propagated in Cilium's GatewayAPI controller, Gateway resources are able to access secrets in other namespaces after the associated ReferenceGrant has been revoked. This can lead to Gateways continuing to establish sessions using secrets that they should no longer have access to.
Patches
This issue was resolved in https://github.com/cilium/cilium/pull/34032.
This issue affects:
This issue has been patched in:
Workarounds
Any modification of a related Gateway/HTTPRoute/GRPCRoute/TCPRoute CRD (for example, adding any label to any of these resources) will trigger a reconciliation of ReferenceGrants on an affected cluster.
Acknowledgements
The Cilium community has worked together with members of Cure53 and Isovalent to prepare these mitigations. Special thanks to @sayboras for resolving this issue.
For more information
If you have any questions or comments about this advisory, please reach out on Slack.
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
Gateway API route matching order contradicts specification in github.com/cilium/cilium
BIT-cilium-2024-42487 / BIT-cilium-operator-2024-42487 / BIT-hubble-relay-2024-42487 / CVE-2024-42487 / GHSA-qcm3-7879-xcww / GO-2024-3071
More information
Details
Gateway API route matching order contradicts specification in github.com/cilium/cilium
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API
BIT-cilium-2024-42486 / BIT-cilium-operator-2024-42486 / BIT-hubble-relay-2024-42486 / CVE-2024-42486 / GHSA-vwf8-q6fw-4wcm / GO-2024-3074
More information
Details
Impact
Due to ReferenceGrant changes not being immediately propagated in Cilium's GatewayAPI controller, Gateway resources are able to access secrets in other namespaces after the associated ReferenceGrant has been revoked. This can lead to Gateways continuing to establish sessions using secrets that they should no longer have access to.
Patches
This issue was resolved in https://github.com/cilium/cilium/pull/34032.
This issue affects:
This issue has been patched in:
Workarounds
Any modification of a related Gateway/HTTPRoute/GRPCRoute/TCPRoute CRD (for example, adding any label to any of these resources) will trigger a reconciliation of ReferenceGrants on an affected cluster.
Acknowledgements
The Cilium community has worked together with members of Cure53 and Isovalent to prepare these mitigations. Special thanks to @sayboras for resolving this issue.
For more information
If you have any questions or comments about this advisory, please reach out on Slack.
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium
BIT-cilium-2024-42488 / BIT-cilium-operator-2024-42488 / BIT-hubble-relay-2024-42488 / CVE-2024-42488 / GHSA-q7w8-72mr-vpgw / GO-2024-3072
More information
Details
Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Gateway API route matching order contradicts specification
BIT-cilium-2024-42487 / BIT-cilium-operator-2024-42487 / BIT-hubble-relay-2024-42487 / CVE-2024-42487 / GHSA-qcm3-7879-xcww / GO-2024-3071
More information
Details
Impact
Gateway API HTTPRoutes and GRPCRoutes do not follow the match precedence specified in the Gateway API specification. In particular, request headers are matched before request methods, when the specification describes that the request methods must be respected before headers are matched (HTTPRouteRule, GRPCRouteRule).
If users create Gateway API resources that use both request headers and request methods in order to route to different destinations, then traffic may be delivered to the incorrect backend. If the backend does not have Network Policy restricting acceptable traffic to receive, then requests may access information that you did not intend for them to access.
Patches
This issue was fixed in https://github.com/cilium/cilium/pull/34109.
This issue affects:
This issue is fixed in:
Workarounds
There is no workaround for this issue.
Acknowledgements
The Cilium community has worked together with members of Cure53 and Isovalent to prepare these mitigations. Special thanks to @sayboras for remediating this issue.
Further information
If you have any questions or comments about this advisory, please reach out on Slack.
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Policy bypass for Host Firewall policy due to race condition in Cilium agent
BIT-cilium-2024-42488 / BIT-cilium-operator-2024-42488 / BIT-hubble-relay-2024-42488 / CVE-2024-42488 / GHSA-q7w8-72mr-vpgw / GO-2024-3072
More information
Details
Impact
A race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass.
Patches
This issue was fixed in https://github.com/cilium/cilium/pull/33511.
This issue affects:
This issue has been patched in:
Workarounds
As the underlying issue depends on a race condition, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected.
Acknowledgements
The Cilium community has worked together with members of Google and Isovalent to prepare these mitigations. Special thanks to @skmatti for raising and resolving this issue.
For more information
If you have any questions or comments about this advisory, please reach out on Slack.
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium
BIT-cilium-2024-42486 / BIT-cilium-operator-2024-42486 / BIT-hubble-relay-2024-42486 / CVE-2024-42486 / GHSA-vwf8-q6fw-4wcm / GO-2024-3074
More information
Details
Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Release Notes
cilium/cilium (github.com/cilium/cilium)
v1.15.8: 1.15.8Compare Source
Security Advisories
This release addresses the following security vulnerabilities:
Summary of Changes
Minor Changes:
Bugfixes:
Node IP as defined in the Kubernetes Node is now preferred when selecting the NodePort frontend IPs. (Backport PR #33818, Upstream PR #33629, @joamaki)
Fix spurious updates node addresses to avoid unnecessary datapath reinitializations. (Backport PR #34086, Upstream PR #34012, @joamaki)
CI Changes:
Misc Changes:
7e0e13a(v1.15) (#33792, @cilium-renovate[bot])mapstate.Diff()used in tests (Backport PR #33809, Upstream PR #33449, @jrajahalme)Other Changes:
Docker Manifests
cilium
quay.io/cilium/cilium:v1.15.8@​sha256:3b5b0477f696502c449eaddff30019a7d399f077b7814bcafabc636829d194c7clustermesh-apiserver
quay.io/cilium/clustermesh-apiserver:v1.15.8@​sha256:4c1f33aae2b76392b57e867820471b5472f0886f7358513d47ee80c09af15a0edocker-plugin
quay.io/cilium/docker-plugin:v1.15.8@​sha256:15b1b6e83e1c0eea97df179660c1898661c1d0da5d431c68f98c702581e29310hubble-relay
quay.io/cilium/hubble-relay:v1.15.8@​sha256:47e8a19f60d0d226ec3d2c675ec63908f1f2fb936a39897f2e3255b3bab01ad6operator-alibabacloud
quay.io/cilium/operator-alibabacloud:v1.15.8@​sha256:388ef72febd719bc9d16d5ee47fe6f846f73f0d8a6f9586ada04cb39eb2962d1operator-aws
quay.io/cilium/operator-aws:v1.15.8@​sha256:3807dd23c2b5f90489824ddd13dca6e84e714dc9eae44e5718acfe86c855b7a1operator-azure
quay.io/cilium/operator-azure:v1.15.8@​sha256:c517db3d12fcf038a9a4a81b88027a19672078bf8c2fcd6b2563f3eff9514d21operator-generic
quay.io/cilium/operator-generic:v1.15.8@​sha256:e77ae6fc8a978f98363cf74d3c883dfaa6454c6e23ec417a60952f29408e2f18operator
quay.io/cilium/operator:v1.15.8@​sha256:e9cf35fe3dc86933ccf3fdfdb7620d218c50aaca5f14e4ba5f422460ea4cb23cv1.15.7: 1.15.7Compare Source
Summary of Changes
We are pleased to release Cilium v1.15.7, which makes the load balancer class of the Clustermesh API server configurable and includes stability and bug fixes. Thanks to all contributors, reviewers, testers, and users!
Minor Changes:
Bugfixes:
CI Changes:
Misc Changes:
511e3d9(v1.15) (#33208, @cilium-renovate[bot])2eb85b8(v1.15) (#33174, @cilium-renovate[bot])b405b62(v1.15) (#33336, @cilium-renovate[bot])488f80a(v1.15) (#33660, @cilium-renovate[bot])Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.