x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2023-30851

[GoVulnBot]

CVE-2023-30851 references github.com/cilium/cilium, which may be a Go module.

Description:
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple toEndpoints AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-30851
• JSON: https://github.com/CVEProject/cvelist/tree/3b90fea9fd150a88b34e38e03f5041ba4bc4c697/2023/30xxx/CVE-2023-30851.json
• advisory: GHSA-2h44-x2wx-49f4
• web: https://github.com/cilium/cilium/releases/tag/v1.11.16
• web: https://github.com/cilium/cilium/releases/tag/v1.12.9
• web: https://github.com/cilium/cilium/releases/tag/v1.13.2
• Imported by: https://pkg.go.dev/github.com/cilium/cilium?tab=importedby

Cross references:

• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-c66w-hq56-4q97 #393 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2022-29178 #457 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2022-29179 #458 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-wc5v-r48v-g4vh #530 NOT_GO_CODE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-pfhr-pccp-hwmh #959 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-4hc4-pgfx-3mrx #1642 NOT_GO_CODE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-8fg8-jh2h-f2hc #1643 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-r5x6-w42p-jhpp #1644 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/cilium/cilium
    packages:
      - package: cilium
description: |
    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.
cves:
  - CVE-2023-30851
references:
  - advisory: https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4
  - web: https://github.com/cilium/cilium/releases/tag/v1.11.16
  - web: https://github.com/cilium/cilium/releases/tag/v1.12.9
  - web: https://github.com/cilium/cilium/releases/tag/v1.13.2

[gopherbot]

Change https://go.dev/cl/507896 mentions this issue: data/excluded: batch add 10 excluded reports

[tatianab]

Duplicate of #1785