x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2023-27594

[GoVulnBot]

CVE-2023-27594 references github.com/cilium/cilium, which may be a Go module.

Description:
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, under specific conditions, Cilium may misattribute the source IP address of traffic to a cluster, identifying external traffic as coming from the host on which Cilium is running. As a consequence, network policies for that cluster might be bypassed, depending on the specific network policies enabled. This issue only manifests when Cilium is routing IPv6 traffic and NodePorts are used to route traffic to pods. IPv6 and endpoint routes are both disabled by default. The problem has been fixed and is available on versions 1.11.15, 1.12.8, and 1.13.1. As a workaround, disable IPv6 routing.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-27594
• JSON: https://github.com/CVEProject/cvelist/tree/444a3559357cd120a53a4c66b1be706a010a0057/2023/27xxx/CVE-2023-27594.json
• web: https://github.com/cilium/cilium/releases/tag/v1.11.15
• web: https://github.com/cilium/cilium/releases/tag/v1.12.8
• web: https://github.com/cilium/cilium/releases/tag/v1.13.1
• advisory: GHSA-8fg8-jh2h-f2hc
• Imported by: https://pkg.go.dev/github.com/cilium/cilium?tab=importedby

Cross references:

• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-c66w-hq56-4q97 #393 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2022-29178 #457 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2022-29179 #458 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-wc5v-r48v-g4vh #530 NOT_GO_CODE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-pfhr-pccp-hwmh #959 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/cilium/cilium
    packages:
      - package: cilium
description: |
    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, under specific conditions, Cilium may misattribute the source IP address of traffic to a cluster, identifying external traffic as coming from the host on which Cilium is running. As a consequence, network policies for that cluster might be bypassed, depending on the specific network policies enabled. This issue only manifests when Cilium is routing IPv6 traffic and NodePorts are used to route traffic to pods. IPv6 and endpoint routes are both disabled by default. The problem has been fixed and is available on versions 1.11.15, 1.12.8, and 1.13.1. As a workaround, disable IPv6 routing.
cves:
  - CVE-2023-27594
references:
  - web: https://github.com/cilium/cilium/releases/tag/v1.11.15
  - web: https://github.com/cilium/cilium/releases/tag/v1.12.8
  - web: https://github.com/cilium/cilium/releases/tag/v1.13.1
  - advisory: https://github.com/cilium/cilium/security/advisories/GHSA-8fg8-jh2h-f2hc

[jba]

Duplicate of #1643