CVE-2023-41333

CVSS 3.1 Score 6.9 of 10 (medium)

Details

Published Sep 27, 2023
Updated: Sep 30, 2023
CWE ID 306

Summary

CVE-2023-41333 is a vulnerability in Cilium, a networking, observability, and security solution with an eBPF-based dataplane. It allows an attacker with API server access to create or modify CiliumNetworkPolicy objects in a specific namespace, enabling them to impact traffic across the entire Cilium cluster and potentially bypass policy enforcement in other namespaces. This can result in the attacker being able to allow or deny all traffic on the cluster. The issue has been resolved in Cilium versions 1.14.2, 1.13.7, and 1.12.14. As a temporary workaround, organizations can utilize an admission webhook to prevent the use of certain endpointSelectors that exploit this vulnerability in CiliumNetworkPolicies. The vulnerability has a base severity rating of MEDIUM and poses a potential danger to organizations that use Cilium for networking and security purposes on their clusters.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-41333 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options