CVE-2023-30851

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-30851

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-30851.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-30851

Aliases

Downstream

CGA (36)

Published

2023-05-25T17:47:51Z

Modified

2026-10-21T02:30:26Z

Severity

2.6 (Low) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N CVSS Calculator

Summary

Potential HTTP policy bypass when using header rules in Cilium

Details

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple toEndpoints AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-693"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30851.json"
}

References

Affected packages

Git / github.com/cilium/cilium

Affected ranges

Type

GIT

Repo

https://github.com/cilium/cilium

Events

Introduced

Fixed

9ce6d643e44b3a7894827d339859f0581aad4531

Introduced

9447cd1bfab4424ccb59b5ea9ca41f89590261d4

Fixed

e0bb30aa24aa7a6966c1a0aa52e10cdb34a02cd7

Introduced

c9723a8df3cfa336da1f8457a864105d8349acfe

Fixed

8cb94c70f7105f29a69e754d2b8969117e681775

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.11.16"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.12.0"
                },
                {
                    "fixed":  "1.12.9"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.13.0"
                },
                {
                    "fixed":  "1.13.2"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "original_tag":  "v1.11.16",
            "range":  [
                {
                    "fixed":  "9ce6d643e44b3a7894827d339859f0581aad4531"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v1.12.9",
            "range":  [
                {
                    "fixed":  "e0bb30aa24aa7a6966c1a0aa52e10cdb34a02cd7"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v1.13.2",
            "range":  [
                {
                    "fixed":  "8cb94c70f7105f29a69e754d2b8969117e681775"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*

1.10.0-rc0

1.11.0

1.11.0-rc0

1.11.0-rc1

1.11.0-rc2

1.11.0-rc3

1.11.1

1.11.10

1.11.11

1.11.12

1.11.13

1.11.14

1.11.15

1.11.2

1.11.3

1.11.4

1.11.5

1.11.6

1.11.7

1.11.8

1.11.9

1.12.0

1.12.1

1.12.2

1.12.3

1.12.4

1.12.5

1.12.6

1.12.7

1.12.8

1.13.0

1.13.1

1.5.0-rc2

1.8.0-rc1

1.9.0-rc0

1.9.0-rc1

v0.*

v0.10.0

v0.13.1

v0.13.10

v0.13.14

v0.13.15

v0.13.16

v0.13.17

v0.13.18

v0.13.19

v0.13.2

v0.13.20

v0.13.21

v0.13.22

v0.13.25

v0.13.4

v0.13.5

v0.13.6

v0.13.8

v0.8.0

v0.8.2

v0.9.0-rc1

v1.*

v1.0.0-rc1

v1.0.0-rc4

v1.0.0-rc5

v1.0.0-rc6

v1.0.0-rc7

v1.0.0-rc8

v1.0.0-rc9

v1.10.0-rc0

v1.11.0

v1.11.0-rc0

v1.11.0-rc1

v1.11.0-rc2

v1.11.0-rc3

v1.11.1

v1.11.10

v1.11.11

v1.11.12

v1.11.13

v1.11.14

v1.11.15

v1.11.2

v1.11.3

v1.11.4

v1.11.5

v1.11.6

v1.11.7

v1.11.8

v1.11.9

v1.12.0

v1.12.1

v1.12.2

v1.12.3

v1.12.4

v1.12.5

v1.12.6

v1.12.7

v1.12.8

v1.13.0

v1.13.1

v1.3.0-rc1

v1.5.0-rc1

v1.5.0-rc2

v1.6.0-rc1

v1.6.0-rc2

v1.6.0-rc3

v1.7.0-rc1

v1.7.0-rc2

v1.8.0-rc1

v1.9.0-rc0

v1.9.0-rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-30851.json"