Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1nOGZjLXZyY2ctOHZqZ84AA7BP

Constallation has pods exposed to peers in VPC

Impact

Cilium allows outside actors (world entity) to directly access pods with their internal pod IP, even if they are not exposed explicitly (e.g. via LoadBalancer). A pod that does not authenticate clients and that does not exclude world traffic via network policy may leak sensitive data to an attacker inside the cloud VPC.

Patches

The issue has been patched in v2.16.3.

Workarounds

This network policy excludes all world traffic. It mitigates the problem, but will also block all desired external traffic. If vulnerable pods are known, a policy can be crafted to only firewall those instead (see also https://docs.cilium.io/en/stable/security/policy/language/#access-to-from-outside-cluster).

apiVersion: "cilium.io/v2"
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: "from-world-to-role-public"
spec:
  endpointSelector:
    matchLabels: {}
    #  role: public
  ingressDeny:
    - fromEntities:
      - world

References

The tracking bug for a Cilium-side fix is https://github.com/cilium/cilium/issues/25626.

Permalink: https://github.com/advisories/GHSA-g8fc-vrcg-8vjg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nOGZjLXZyY2ctOHZqZ84AA7BP
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 16 days ago
Updated: 14 days ago

Identifiers: GHSA-g8fc-vrcg-8vjg
References:

• https://github.com/edgelesssys/constellation/security/advisories/GHSA-g8fc-vrcg-8vjg
• https://github.com/cilium/cilium/issues/25626
• https://github.com/advisories/GHSA-g8fc-vrcg-8vjg

Repository: https://github.com/edgelesssys/constellation
Blast Radius: 0.0

Affected Packages