Skip to content

fix(deps): update module github.com/cilium/cilium to v1.16.9 [security] #516

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update module github.com/cilium/cilium to v1.16.9 [security] #516

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Aug 6, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
github.com/cilium/cilium v1.16.1 -> v1.16.9 age adoption passing confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2024-52529

Impact

For users with the following configuration:

then Layer 7 enforcement would not occur for the traffic selected by the Layer 7 policy.

This issue only affects users who use Cilium's port range functionality, which was introduced in Cilium v1.16.

For reference, an example of a pair of policies that would trigger this issue is:

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "layer-3-and-4"
spec:
  endpointSelector:
    matchLabels:
      app: service
  ingress:
    - fromCIDR:
      - 192.168.60.0/24
      toPorts:
      - ports:
        - port: "80"
          endPort: 444
          protocol: TCP

and

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "layer-4-and-7"
spec:
  endpointSelector:
    matchLabels:
      app: service
  ingress:
    toPorts:
    - ports:
      - port: "80"
        protocol: TCP
      rules:
        http:
        - method: "GET"
          path: "/public"

In the above example, requests would be permitted to all HTTP paths on matching endpoints, rather than just GET requests to the /public path as intended by the layer-4-and-7 policy. In patched versions of Cilium, the layer-4-and-7 rule would take precedence over the layer-3-and-4 rule.

Patches

This issue is patched in https://github.com/cilium/cilium/pull/35150.

This issue affects Cilium v1.16 between v1.16.0 and v1.16.3 inclusive.

This issue is patched in Cilium v1.16.4.

Workarounds

Users with network policies that match the pattern described above can work around the issue by rewriting any policies that use port ranges to individually specify the ports permitted for traffic.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @​jrajahalme for resolving this issue.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.

CVE-2025-23028

Impact

In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster.

For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart.

Patches

This issue affects:

  • Cilium v1.14 between v1.14.0 and v1.14.17 inclusive
  • Cilium v1.15 between v1.15.0 and v1.15.11 inclusive
  • Cilium v1.16 between v1.16.0 and v1.16.4 inclusive

This issue is fixed in:

  • Cilium v1.14.18
  • Cilium v1.15.12
  • Cilium v1.16.5

Workarounds

There are no known workarounds to this issue.

Acknowledgements

The Cilium community has worked together with members of Isovalent and the Cisco Advanced Security Initiatives Group (ASIG) to prepare these mitigations. Special thanks to @​kokelley-cisco for reporting this issue and @​bimmlerd for the fix.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.

CVE-2025-23047

Impact

For users who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart, an insecure default Access-Control-Allow-Origin header value could lead to sensitive data exposure. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page.

Patches

This issue was patched in cilium/cilium@a3489f1

This issue affects:

  • Cilium between v1.14.0 and v1.14.18 inclusive
  • Cilium between v1.15.0 and v1.15.12 inclusive
  • Cilium between v1.16.0 and v1.16.5 inclusive

This issue is patched in:

  • Cilium v1.14.19
  • Cilium v1.15.13
  • Cilium v1.16.6

Workarounds

Users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @​ciffelia for reporting this issue and to @​geakstr for the fix.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.

CVE-2025-30162

Impact

For Cilium users who:

  • Use Gateway API for Ingress for some services AND
  • Use LB-IPAM or BGP for LB Service implementation AND
  • Use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces

Egress traffic from workloads covered by such network policies to LoadBalancers configured by Gateway resources will incorrectly be allowed.

LoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue.

Patches

This issue was fixed by https://github.com/cilium/proxy/pull/1172.

This issue affects:

  • Cilium v1.15 between v1.15.0 and v1.15.14 inclusive
  • Cilium v1.16 between v1.16.0 and v1.16.7 inclusive
  • Cilium v1.17 between v1.17.0 and v1.17.1 inclusive

This issue is fixed in:

  • Cilium v1.15.15
  • Cilium v1.16.8
  • Cilium v1.17.2

Workarounds

A Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade. An outline of such a policy is provided below:

apiVersion: "cilium.io/v2"
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: "workaround"
spec:
  endpointSelector:
    matchExpressions:
    - key: reserved:ingress
      operator: Exists
  ingress:
  - fromEntities:
    - world
  • The policy opens up connectivity from all locations outside the cluster into the Cilium Ingress Gateway.
  • The policy establishes a default deny for all other traffic towards the Cilium Ingress Gateway, including all in-cluster sources.
  • It is possible to tailor the policy to more narrowly allow inbound traffic while creating a default deny posture for traffic between namespaces. Users should edit the policy to bring it in line with the security requirements particular to their environments.

Acknowledgements

The Cilium community has worked together with members of the Isovalent team to prepare these mitigations. Special thanks to @​jrajahalme for the fix.

For more information

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.

CVE-2025-30163

Impact

Node based network policies (fromNodes and toNodes) will incorrectly permit traffic to/from non-node endpoints that share the labels specified in fromNodes and toNodes sections of network policies. Node based network policy is disabled by default in Cilium.

Patches

This issue was fixed by https://github.com/cilium/cilium/pull/36657.

This issue affects:

  • Cilium v1.16 between v1.16.0 and v1.16.7 inclusive
  • Cilium v1.17 between v1.17.0 and v1.17.1 inclusive

This issue is fixed in:

  • Cilium v1.16.8
  • Cilium v1.17.2

Workarounds

Users can work around this issue by ensuring that the labels used in fromNodes and toNodes fields are used exclusively by nodes and not by other endpoints.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @​oblazek for reporting and fixing this issue.

For more information

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority. Please also address any comments or questions on this advisory to the same mailing list.

CVE-2025-32793

Impact

When using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium.

Patches

This issue has been patched in https://github.com/cilium/cilium/pull/38592.

This issue affects:

  • Cilium v1.15 between v1.15.0 and v1.15.15 inclusive
  • Cilium v1.16 between v1.16.0 and v1.16.8 inclusive
  • Cilium v1.17 between v1.17.0 and v1.17.2 inclusive

This issue is fixed in:

  • Cilium v1.15.16
  • Cilium v1.16.9
  • Cilium v1.17.3

Workarounds

There is no workaround to this issue.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @​gandro and @​pippolo84 for reporting this issue and to @​julianwiedmann for the patch.

For more information

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.

Release Notes

cilium/cilium (github.com/cilium/cilium)

v1.16.9: 1.16.9

Compare Source

Summary of Changes

Minor Changes:

  • Reject IPSec key rotation with mismatching key lengths to prevent IPv6 disruptions. (Backport PR #​38400, Upstream PR #​37936, @​smagnani96)
  • Skip WireGuard traffic in the BPF SNAT processing, slightly reducing pressure on the BPF Connection tracking and NAT maps. (Backport PR #​38747, Upstream PR #​35900, @​smagnani96)

Bugfixes:

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests

cilium

quay.io/cilium/cilium:v1.16.9@​sha256:98f8e547fd0720e042a1eb7bd6f50a521cbe0a8ea8e013f783f1709fc023c266

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.16.9@​sha256:69b9b80046f2a293de96e228ffdf7803bdd387d2c8cc6fa836a240c4932d7066

docker-plugin

quay.io/cilium/docker-plugin:v1.16.9@​sha256:867b37f934411c11e9e50d0d691a2d1376ec4fe4c573c9b3af6950d559a97b28

hubble-relay

quay.io/cilium/hubble-relay:v1.16.9@​sha256:c978b77e607cc7fb9a92741464470002a192af47c5dec57b83f693919857199e

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.16.9@​sha256:59d2a5d5ab017c974c42eeb7f265f9b91aafad2ee6c73d5dffe0bfe44bedd134

operator-aws

quay.io/cilium/operator-aws:v1.16.9@​sha256:f00e854ad7ae0c55e0e2352b71a98fe1358ba029e2e93b236a18c3b43664f948

operator-azure

quay.io/cilium/operator-azure:v1.16.9@​sha256:549ef9d238b84313f4a9f25518a77ec16cc9b86a19e66242bee920eb9c065fea

operator-generic

quay.io/cilium/operator-generic:v1.16.9@​sha256:0489f71dfeff23d1fbc4ee85a81a0274076ab2b53072aadbdf5963e83dc3faf7

operator

quay.io/cilium/operator:v1.16.9@​sha256:c8d0d6ca36d49bdeeb82d75b58a061f10e9e402d493241d648c4e329027b67ee

v1.16.8: 1.16.8

Compare Source

Summary of Changes

Minor Changes:

Bugfixes:

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests

cilium

quay.io/cilium/cilium:v1.16.8@​sha256:569ec9056ef2e3b283edb508b31e4ff04058cb7bd551cc9433512ebdef07804d

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.16.8@​sha256:5ea1c42de93879a853e35a1287dfc0c2bcf912fcdc8ce092dfb322819123c8ea

docker-plugin

quay.io/cilium/docker-plugin:v1.16.8@​sha256:74664fa646f3fe6b8615830b21073602dece8b5397db7384b5aa0e585857265e

hubble-relay

quay.io/cilium/hubble-relay:v1.16.8@​sha256:498c04894fc95b6792d713dfb5e11aad236d41433710ddf73425483e855170be

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.16.8@​sha256:409009711eab9e0f97c13c67c9b18aa48be130d970f09b067e1ae35df24b2252

operator-aws

quay.io/cilium/operator-aws:v1.16.8@​sha256:c596b30650899c5ecde8b114e0a4e8679f83122c2477056d8d437df78b7a981b

operator-azure

quay.io/cilium/operator-azure:v1.16.8@​sha256:c9dc8757e5941c72764b4a73d39c270378f156cc005722db95c77e0d1897dd04

operator-generic

quay.io/cilium/operator-generic:v1.16.8@​sha256:86c879ed25396a992fb8bf0297289f0b61f30f9a4a260f483abbdb39d919644d

operator

quay.io/cilium/operator:v1.16.8@​sha256:c2b0716672ce2bf68c2679c8b98ddab4c80f2c6891560e538ce4e117240ba220

v1.16.7: 1.16.7

Compare Source

Summary of Changes

Minor Changes:

Bugfixes:

CI Changes:

Misc Changes:

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate Renovate
Copy link
Contributor Author

renovate bot commented Aug 6, 2024 •
edited
Loading

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 19 additional dependencies were updated

Details:

Package Change
github.com/cilium/proxy v0.0.0-20240418093727-2c7164c53e26 -> v0.0.0-20241210133824-eaae5aca0fb9
github.com/go-jose/go-jose/v4 v4.0.2 -> v4.0.5
github.com/petermattis/goid v0.0.0-20230904192822-1876fd5063bc -> v0.0.0-20240813172612-4fcff4a6cae7
github.com/sasha-s/go-deadlock v0.3.1 -> v0.3.5
github.com/stretchr/testify v1.9.0 -> v1.10.0
github.com/vishvananda/netlink v1.2.1-beta.2.0.20240524165444-4d4ba1473f21 -> v1.3.1-0.20241022031324-976bd8de7d81
go.opentelemetry.io/proto/otlp v1.2.0 -> v1.3.1
golang.org/x/crypto v0.24.0 -> v0.32.0
golang.org/x/net v0.26.0 -> v0.33.0
golang.org/x/oauth2 v0.20.0 -> v0.23.0
golang.org/x/sync v0.7.0 -> v0.10.0
golang.org/x/sys v0.21.0 -> v0.29.0
golang.org/x/term v0.21.0 -> v0.28.0
golang.org/x/text v0.16.0 -> v0.21.0
google.golang.org/genproto/googleapis/api v0.0.0-20240515191416-fc5f0ca64291 -> v0.0.0-20241206012308-a4fef0638583
google.golang.org/genproto/googleapis/rpc v0.0.0-20240624140628-dc46fd24d27d -> v0.0.0-20241206012308-a4fef0638583
google.golang.org/grpc v1.64.1 -> v1.68.1
google.golang.org/protobuf v1.34.2 -> v1.35.2
k8s.io/klog/v2 v2.120.1 -> v2.130.1

@renovate renovate bot force-pushed the renovate/go-github.com-cilium-cilium-vulnerability branch from 47d96b1 to 2c5f3c3 Compare August 15, 2024 22:53
@renovate renovate bot changed the title fix(deps): update module github.com/cilium/cilium to v1.14.12 [security] fix(deps): update module github.com/cilium/cilium to v1.14.14 [security] Aug 15, 2024
@renovate renovate bot force-pushed the renovate/go-github.com-cilium-cilium-vulnerability branch from 2c5f3c3 to 696e82f Compare September 24, 2024 02:37
@renovate renovate bot force-pushed the renovate/go-github.com-cilium-cilium-vulnerability branch from 696e82f to fb41938 Compare October 21, 2024 20:18
@renovate renovate bot changed the title fix(deps): update module github.com/cilium/cilium to v1.14.14 [security] fix(deps): update module github.com/cilium/cilium to v1.14.16 [security] Oct 21, 2024
@renovate renovate bot force-pushed the renovate/go-github.com-cilium-cilium-vulnerability branch from fb41938 to 7c5e084 Compare January 5, 2025 23:03
@renovate renovate bot changed the title fix(deps): update module github.com/cilium/cilium to v1.14.16 [security] fix(deps): update module github.com/cilium/cilium to v1.16.4 [security] Jan 5, 2025
@renovate renovate bot force-pushed the renovate/go-github.com-cilium-cilium-vulnerability branch 2 times, most recently from f932316 to 313ae89 Compare January 22, 2025 20:50
@renovate renovate bot changed the title fix(deps): update module github.com/cilium/cilium to v1.16.4 [security] fix(deps): update module github.com/cilium/cilium to v1.16.6 [security] Jan 22, 2025
@renovate renovate bot force-pushed the renovate/go-github.com-cilium-cilium-vulnerability branch from 313ae89 to 79fe590 Compare March 24, 2025 19:57
@renovate renovate bot changed the title fix(deps): update module github.com/cilium/cilium to v1.16.6 [security] fix(deps): update module github.com/cilium/cilium to v1.16.8 [security] Mar 24, 2025
@renovate renovate bot force-pushed the renovate/go-github.com-cilium-cilium-vulnerability branch from 79fe590 to 9c779bc Compare April 21, 2025 19:27
@renovate renovate bot changed the title fix(deps): update module github.com/cilium/cilium to v1.16.8 [security] fix(deps): update module github.com/cilium/cilium to v1.16.9 [security] Apr 21, 2025
@renovate Renovate
Copy link
Contributor Author

renovate bot commented Apr 21, 2025

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go get -d -t ./...
go: module github.com/cilium/[email protected] requires go >= 1.23.0; switching to go1.23.8
go: downloading go1.23.8 (linux/amd64)
go: download go1.23.8: golang.org/[email protected]: verifying module: checksum database disabled by GOSUMDB=off

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants