3.4

CVSS Score

3.1

Basic Information

CVE ID

CVE-2023-34242

GHSA ID

GHSA-r7wr-4w5q-55m6

EPSS Score

0.15542%

CWE

CWE-200

Published

6/16/2023

Updated

11/8/2023

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-34242

CVE-2023-34242: Cilium vulnerable to information leakage via incorrect ReferenceGrant handling

Impact

When the Gateway API is enabled in Cilium, the absence of a check on the namespace in which a ReferenceGrant is created could result in Cilium gaining visibility of secrets (including certificates) and services across namespaces.

An attacker on an affected cluster can configure Cilium to use cluster secrets or communicate with services that it should not have access to.

Gateway API functionality is disabled by default.

Patches

This vulnerability is fixed in Cilium release 1.13.4.

Cilium versions <1.13 are not affected.

Workarounds

There is no workaround to this issue.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @meyskens for investigating and fixing the issue.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: security@cilium.io - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.

(GitHub Advisory)

3.4

CVSS Score

3.1

Basic Information

CVE ID

CVE-2023-34242

GHSA ID

GHSA-r7wr-4w5q-55m6

EPSS Score

0.15542%

CWE

CWE-200

Published

6/16/2023

Updated

11/8/2023

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/cilium/cilium	go	>= 1.13.0, < 1.13.4	1.13.4

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from improper namespace validation when handling ReferenceGrants in the Gateway API implementation. Key indicators:

The CVE description explicitly mentions missing namespace checks on ReferenceGrant creation
Gateway API's security model requires ReferenceGrants to be namespace-scoped protections
The fix version (1.13.4) likely added namespace validation in ReferenceGrant handling logic
The affected functionality relates to cross-namespace secret/service access authorization

While exact code diffs aren't available, the pattern matches common Kubernetes admission control issues where namespace-boundary checks are missing in reference validation functions. The high-confidence entry point is the ReferenceGrant controller's handling logic, while the admission webhook validation is a secondary potential location.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t W**n t** [**t*w*y *PI](*ttps://*o*s.*ilium.io/*n/v*.**/n*twork/s*rvi**m*s*/**t*w*y-*pi/**t*w*y-*pi/) is *n**l** in *ilium, t** **s*n** o* * ****k on t** n*m*sp*** in w*i** * [R***r*n***r*nt](*ttps://**t*w*y-*pi.si*s.k*s.io/*pi-typ*s/r***r

Reasoning

T** vuln*r**ility st*ms *rom improp*r n*m*sp*** v*li**tion w**n **n*lin* R***r*n***r*nts in t** **t*w*y *PI impl*m*nt*tion. K*y in*i**tors: *. T** *V* **s*ription *xpli*itly m*ntions missin* n*m*sp*** ****ks on R***r*n***r*nt *r**tion *. **t*w*y *PI'

3.4

Basic Information

Concerned about an active attack path?

CVE-2023-34242: Cilium vulnerable to information leakage via incorrect ReferenceGrant handling

Impact

Patches

Workarounds

Acknowledgements

For more information

3.4

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI