Debug mode leaks confidential data in Cilium
CVE-2023-29002

7.2HIGH

Key Information:

Vendor

Cilium

Status
Cilium
Vendor
CVE Published:
18 April 2023

What is CVE-2023-29002?

Cilium, a networking, observability, and security solution, is susceptible to an information disclosure vulnerability when operated in debug mode. This vulnerability allows potentially sensitive data, such as TLS private keys for Ingress and GatewayAPI resources, to be logged in the 'cilium-secrets' namespace. If an unauthorized attacker gains access to the debug output of the Cilium containers, they can intercept and modify ongoing traffic within the affected cluster. The exposure of sensitive information can occur during Cilium agent restarts, whenever secrets are modified, or upon creation of Ingress or GatewayAPI resources. It is recommended that users upgrade to the fixed versions: 1.11.16, 1.12.9, or 1.13.2, or disable debug mode if an upgrade is not possible.

Affected Version(s)

cilium >= 1.7, < 1.11.16 < 1.7, 1.11.16

cilium >= 1.12.0, < 1.12.9 < 1.12.0, 1.12.9

cilium >= 1.13.0, < 1.13.2 < 1.13.0, 1.13.2

References

https://github.com/cilium/cilium/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.