{"id":"GHSA-g8fc-vrcg-8vjg","aliases":["GO-2024-2727"],"url":"https://o3.security/vulnerability/GHSA-g8fc-vrcg-8vjg","summary":"Constallation has pods exposed to peers in VPC","details":"### Impact\n\nCilium allows outside actors (`world` entity) to directly access pods with their internal pod IP, even if they are not exposed explicitly (e.g. via `LoadBalancer`). A pod that does not authenticate clients and that does not exclude `world` traffic via network policy may leak sensitive data to an attacker _inside the cloud VPC_.\n\n### Patches\n\nThe issue has been patched in [v2.16.3](https://github.com/edgelesssys/constellation/releases/tag/v2.16.3).\n\n### Workarounds\n\nThis network policy excludes all `world` traffic. It mitigates the problem, but will also block all desired external traffic. If vulnerable pods are known, a policy can be crafted to only firewall those instead (see also https://docs.cilium.io/en/stable/security/policy/language/#access-to-from-outside-cluster).\n\n```yaml\napiVersion: \"cilium.io/v2\"\nkind: CiliumClusterwideNetworkPolicy\nmetadata:\n  name: \"from-world-to-role-public\"\nspec:\n  endpointSelector:\n    matchLabels: {}\n    #  role: public\n  ingressDeny:\n    - fromEntities:\n      - world\n```\n\n### References\n\nThe tracking bug for a Cilium-side fix is https://github.com/cilium/cilium/issues/25626. \n","published":"2024-04-15T18:13:15Z","modified":"2024-06-04T19:35:51Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/edgelesssys/constellation/v2","fixedVersion":"2.16.3"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/edgelesssys/constellation/security/advisories/GHSA-g8fc-vrcg-8vjg"},{"type":"WEB","url":"https://github.com/cilium/cilium/issues/25626"},{"type":"PACKAGE","url":"https://github.com/edgelesssys/constellation"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2024-2727"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-06-04T19:35:51Z"}}