x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-2h44-x2wx-49f4

[GoVulnBot]

In GitHub Security Advisory GHSA-2h44-x2wx-49f4, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/cilium/cilium	1.13.2	>= 1.13.0, < 1.13.2

Cross references:

• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-c66w-hq56-4q97 #393 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2022-29178 #457 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2022-29179 #458 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-wc5v-r48v-g4vh #530 NOT_GO_CODE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-pfhr-pccp-hwmh #959 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-4hc4-pgfx-3mrx #1642 NOT_GO_CODE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-8fg8-jh2h-f2hc #1643 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-r5x6-w42p-jhpp #1644 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/cilium/cilium
    versions:
      - introduced: 1.13.0
        fixed: 1.13.2
    packages:
      - package: github.com/cilium/cilium
  - module: github.com/cilium/cilium
    versions:
      - introduced: 1.12.0
        fixed: 1.12.9
    packages:
      - package: github.com/cilium/cilium
  - module: github.com/cilium/cilium
    versions:
      - fixed: 1.11.16
    packages:
      - package: github.com/cilium/cilium
summary: Potential HTTP policy bypass when using header rules in Cilium
description: "### Impact\n\nThis issue only impacts users who:\n\n- Have a HTTP policy
    that applies to multiple `toEndpoints` AND\n- Have an allow-all rule in place
    that affects only one of those endpoints\n\nIn such cases, a wildcard rule will
    be appended to the set of HTTP rules, which could cause bypass of HTTP policies.\n\n###
    Patches\n\nThis issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.\n\n###
    Workarounds\n\nRewrite HTTP rules for each endpoint separately. For example, if
    the initial rule looks like:\n\n```\n  egress:\n    - toEndpoints:\n        -
    matchLabels:\n            k8s:kind: echo\n        - matchLabels:\n            k8s:kind:
    example\n      toPorts:\n        - ports:\n            - port: \"8080\"\n              protocol:
    TCP\n          rules:\n            http:\n              - method: \"GET\"\n```\n\nIt
    should be rewritten to:\n\n```\n  egress:\n    - toEndpoints:\n        - matchLabels:\n
    \           k8s:kind: echo\n      toPorts:\n        - ports:\n            - port:
    \"8080\"\n              protocol: TCP\n          rules:\n            http:\n              -
    method: \"GET\"\n    - toEndpoints:\n        - matchLabels:\n            k8s:kind:
    example\n      toPorts:\n        - ports:\n            - port: \"8080\"\n              protocol:
    TCP\n          rules:\n            http:\n              - method: \"GET\"\n```
    \    \n\n### Acknowledgements\n\nThe Cilium community has worked together with
    members of Isovalent to prepare these mitigations. Special thanks to @jrajahalme
    for investigating and fixing the issue.\n\n### For more information\n\nIf you
    have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).\n\nAs
    usual, if you think you found a related vulnerability, we strongly encourage you
    to report security vulnerabilities to our private security mailing list: [security@cilium.io](mailto:security@cilium.io)
    - first, before disclosing them in any public forums. This is a private mailing
    list where only members of the Cilium internal security team are subscribed to,
    and is treated as top priority.\n"
cves:
  - CVE-2023-30851
ghsas:
  - GHSA-2h44-x2wx-49f4
references:
  - advisory: https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4
  - web: https://github.com/cilium/cilium/releases/tag/v1.11.16
  - web: https://github.com/cilium/cilium/releases/tag/v1.12.9
  - web: https://github.com/cilium/cilium/releases/tag/v1.13.2
  - advisory: https://github.com/advisories/GHSA-2h44-x2wx-49f4

[gopherbot]

Change https://go.dev/cl/498277 mentions this issue: data/excluded: batch add GO-2023-1785, GO-2023-1789, GO-2023-1787

[gopherbot]

Change https://go.dev/cl/592760 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606786 mentions this issue: data/reports: unexclude 20 reports (6)