Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2024-42487 #3071

Closed
GoVulnBot opened this issue Aug 15, 2024 · 1 comment
Closed

x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2024-42487 #3071

GoVulnBot opened this issue Aug 15, 2024 · 1 comment
Labels
triaged

Comments

@GoVulnBot
Copy link

Advisory CVE-2024-42487 references a vulnerability in the following Go modules:

Module
github.com/cilium/cilium

Description:
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In the 1.15 branch prior to 1.15.8 and the 1.16 branch prior to 1.16.1, Gateway API HTTPRoutes and GRPCRoutes do not follow the match precedence specified in the Gateway API specification. In particular, request headers are matched before request methods, when the specification describes that the request methods must be respected before headers are matched. This could result in unexpected behaviour with security This issue is fixed in Cilium v1.15.8 and v1.16.1. There is no workaround for this issue.

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/cilium/cilium
      vulnerable_at: 1.16.1
summary: CVE-2024-42487 in github.com/cilium/cilium
cves:
    - CVE-2024-42487
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-42487
    - fix: https://github.com/cilium/cilium/commit/a3510fe4a92305822aa1a5e08cb6d6c873c8699a
    - fix: https://github.com/cilium/cilium/pull/34109
    - web: https://github.com/cilium/cilium/security/advisories/GHSA-qcm3-7879-xcww
source:
    id: CVE-2024-42487
    created: 2024-08-15T22:01:12.886994724Z
review_status: UNREVIEWED
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/606235 mentions this issue: data/reports: add 3 unreviewed reports

@GoVulnBot GoVulnBot mentioned this issue Oct 21, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue Nov 25, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@tatianab @gopherbot @GoVulnBot