Access Control Bypass Affecting github.com/cilium/cilium/pkg/policy package, versions <1.11.16 >=1.12.0-rc0 <1.12.9 >=1.13.0-rc0 <1.13.2
Threat Intelligence
EPSS
0.1% (42nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMCILIUMCILIUMPKGPOLICY-5595550
- published 23 May 2023
- disclosed 22 May 2023
- credit Unknown
Introduced: 22 May 2023
CVE-2023-30851 Open this link in a new tabHow to fix?
Upgrade github.com/cilium/cilium/pkg/policy to version 1.11.16, 1.12.9, 1.13.2 or higher.
Overview
github.com/cilium/cilium/pkg/policy is a package for eBPF-based Networking, Security, and Observability
Affected versions of this package are vulnerable to Access Control Bypass when HTTP policies are specified by header rules such that an HTTP policy applies to multiple toEndpoints, and there is an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule is appended to the set of HTTP rules.
CVSS Scores
version 3.1