x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2024-42488

[GoVulnBot]

Advisory CVE-2024-42488 references a vulnerability in the following Go modules:

Module
github.com/cilium/cilium

Description:
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.14.14 and 1.15.8, a race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass. This issue has been patched in Cilium v1.14.14 and v1.15.8 As the underlying issue depends on a race condition, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirme...

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-42488
• FIX: cilium/cilium@aa44dd1
• FIX: fix: Track node labels propagated to the endpoint manager correctly cilium/cilium#33511
• WEB: GHSA-q7w8-72mr-vpgw

Cross references:

• github.com/cilium/cilium appears in 21 other report(s):
  • data/excluded/GO-2022-0393.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-c66w-hq56-4q97 #393) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2022-0457.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2022-29178 #457) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2022-0458.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2022-29179 #458) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2022-0530.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-wc5v-r48v-g4vh #530) NOT_GO_CODE
  • data/excluded/GO-2022-0959.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-pfhr-pccp-hwmh #959) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2023-1642.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-4hc4-pgfx-3mrx #1642) NOT_GO_CODE
  • data/excluded/GO-2023-1643.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-8fg8-jh2h-f2hc #1643) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2023-1644.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-r5x6-w42p-jhpp #1644) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2023-1730.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2023-29002 #1730) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2023-1785.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-2h44-x2wx-49f4 #1785) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2023-1862.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2023-34242 #1862) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2023-2078.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-gj2r-phwg-6rww #2078) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2023-2079.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-24m5-r6hv-ccgp #2079) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2023-2080.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-4xp2-w642-7mcx #2080) EFFECTIVELY_PRIVATE
  • data/reports/GO-2024-2568.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2024-25630 #2568)
  • data/reports/GO-2024-2569.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2024-25631 #2569)
  • data/reports/GO-2024-2653.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-68mj-9pjq-mc85 #2653)
  • data/reports/GO-2024-2656.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-j89h-qrvr-xc36 #2656)
  • data/reports/GO-2024-2657.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-v6q2-4qr3-5cw6 #2657)
  • data/reports/GO-2024-2666.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-pwqm-x5x6-5586 #2666)
  • data/reports/GO-2024-2922.yaml (x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2024-37307 #2922)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/cilium/cilium
      vulnerable_at: 1.16.1
summary: CVE-2024-42488 in github.com/cilium/cilium
cves:
    - CVE-2024-42488
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-42488
    - fix: https://github.com/cilium/cilium/commit/aa44dd148a9be95e07782e4f990e61678ef0abf8
    - fix: https://github.com/cilium/cilium/pull/33511
    - web: https://github.com/cilium/cilium/security/advisories/GHSA-q7w8-72mr-vpgw
source:
    id: CVE-2024-42488
    created: 2024-08-15T22:01:13.559415025Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/606235 mentions this issue: data/reports: add 3 unreviewed reports