CVE-2023-30851

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-30851
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-30851.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-30851
Aliases
Related
Published
2023-05-25T17:47:51.095Z
Modified
2026-04-19T04:16:42.860581Z
Severity
  • 2.6 (Low) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Summary
Potential HTTP policy bypass when using header rules in Cilium
Details

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple toEndpoints AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.

Database specific 
{
    "cwe_ids": [
        "CWE-693"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30851.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/cilium/cilium

Affected ranges

Type
GIT
Repo
https://github.com/cilium/cilium
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9ce6d643e44b3a7894827d339859f0581aad4531
Introduced
9447cd1bfab4424ccb59b5ea9ca41f89590261d4
Fixed
e0bb30aa24aa7a6966c1a0aa52e10cdb34a02cd7
Introduced
c9723a8df3cfa336da1f8457a864105d8349acfe
Fixed
8cb94c70f7105f29a69e754d2b8969117e681775
Database specific 
{
    "source": [
        "CPE_FIELD",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.11.16"
        },
        {
            "introduced": "1.12.0"
        },
        {
            "fixed": "1.12.9"
        },
        {
            "introduced": "1.13.0"
        },
        {
            "fixed": "1.13.2"
        }
    ]
}

Affected versions

1.*
1.10.0-rc0
1.11.0
1.11.0-rc0
1.11.0-rc1
1.11.0-rc2
1.11.0-rc3
1.11.1
1.11.10
1.11.11
1.11.12
1.11.13
1.11.14
1.11.15
1.11.2
1.11.3
1.11.4
1.11.5
1.11.6
1.11.7
1.11.8
1.11.9
1.12.0
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.12.8
1.13.0
1.13.1
1.5.0-rc2
1.8.0-rc1
1.9.0-rc0
1.9.0-rc1
v0.*
v0.10.0
v0.13.1
v0.13.10
v0.13.14
v0.13.15
v0.13.16
v0.13.17
v0.13.18
v0.13.19
v0.13.2
v0.13.20
v0.13.21
v0.13.22
v0.13.25
v0.13.4
v0.13.5
v0.13.6
v0.13.8
v0.8.0
v0.8.2
v0.9.0-rc1
v1.*
v1.0.0-rc1
v1.0.0-rc4
v1.0.0-rc5
v1.0.0-rc6
v1.0.0-rc7
v1.0.0-rc8
v1.0.0-rc9
v1.10.0-rc0
v1.11.0
v1.11.0-rc0
v1.11.0-rc1
v1.11.0-rc2
v1.11.0-rc3
v1.11.1
v1.11.10
v1.11.11
v1.11.12
v1.11.13
v1.11.14
v1.11.15
v1.11.2
v1.11.3
v1.11.4
v1.11.5
v1.11.6
v1.11.7
v1.11.8
v1.11.9
v1.12.0
v1.12.1
v1.12.2
v1.12.3
v1.12.4
v1.12.5
v1.12.6
v1.12.7
v1.12.8
v1.13.0
v1.13.1
v1.3.0-rc1
v1.5.0-rc1
v1.5.0-rc2
v1.6.0-rc1
v1.6.0-rc2
v1.6.0-rc3
v1.7.0-rc1
v1.7.0-rc2
v1.8.0-rc1
v1.9.0-rc0
v1.9.0-rc1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-30851.json"