cilium-1.15.advisories.yaml

schema-version: 2.0.2

package:
  name: cilium-1.15

advisories:
  - id: CVE-2022-29178
    aliases:
      - GHSA-6p8v-8cq8-v2r3
    events:
      - timestamp: 2024-04-26T08:43:15Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: 835185c6e9895d51
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-dbg
            scanner: grype
      - timestamp: 2024-05-05T14:39:55Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.9.16).'

  - id: CVE-2022-29179
    aliases:
      - GHSA-fmrf-gvjp-5j5g
    events:
      - timestamp: 2024-04-26T08:43:20Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: df49fa420728224d
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /opt/cni/bin/cilium-cni
            scanner: grype
      - timestamp: 2024-05-05T14:39:56Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.9.16).'

  - id: CVE-2023-27593
    aliases:
      - GHSA-4hc4-pgfx-3mrx
    events:
      - timestamp: 2024-04-26T08:43:13Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: d2221a73b3cdff7d
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-sysctlfix
            scanner: grype
      - timestamp: 2024-05-05T14:39:53Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.11.15).'

  - id: CVE-2023-27594
    aliases:
      - GHSA-8fg8-jh2h-f2hc
    events:
      - timestamp: 2024-04-26T08:43:18Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: d2221a73b3cdff7d
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-sysctlfix
            scanner: grype
      - timestamp: 2024-05-05T14:39:56Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.11.15).'

  - id: CVE-2023-30851
    aliases:
      - GHSA-2h44-x2wx-49f4
    events:
      - timestamp: 2024-04-26T08:43:12Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: 9687b3fc05fc198d
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-bugtool
            scanner: grype
      - timestamp: 2024-05-05T14:39:53Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.11.16).'

  - id: CVE-2023-39347
    aliases:
      - GHSA-gj2r-phwg-6rww
    events:
      - timestamp: 2024-04-26T08:43:22Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: 410d0ead0998c401
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-health
            scanner: grype
      - timestamp: 2024-05-05T14:39:56Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.12.14).'

  - id: CVE-2023-41332
    aliases:
      - GHSA-24m5-r6hv-ccgp
    events:
      - timestamp: 2024-04-26T08:43:10Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: baf534dc6a830d5e
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-mount
            scanner: grype
      - timestamp: 2024-05-05T14:39:52Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.12.14).'

  - id: CVE-2023-41333
    aliases:
      - GHSA-4xp2-w642-7mcx
    events:
      - timestamp: 2024-04-26T08:43:14Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: 87ebb575655ff1dd
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-health-responder
            scanner: grype
      - timestamp: 2024-05-05T14:39:54Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.12.14).'

  - id: CVE-2023-45288
    aliases:
      - GHSA-4v7x-pqxf-cx7m
    events:
      - timestamp: 2024-04-20T12:24:02Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15-hubble-relay
            componentID: 7ba8f00b9fe43798
            componentName: golang.org/x/net
            componentVersion: v0.20.0
            componentType: go-module
            componentLocation: /usr/bin/hubble-relay
            scanner: grype
      - timestamp: 2024-05-04T16:36:53Z
        type: true-positive-determination
        data:
          note: 'A govulncheck analysis found the several affected symbols in the APK.'

  - id: CVE-2024-24786
    aliases:
      - GHSA-8r3f-844c-mc37
    events:
      - timestamp: 2024-03-14T07:05:34Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15-hubble-relay
            componentID: 778db702fe4c97c6
            componentName: google.golang.org/protobuf
            componentVersion: v1.31.0
            componentType: go-module
            componentLocation: /usr/bin/hubble-relay
            scanner: grype
      - timestamp: 2024-03-15T22:56:26Z
        type: fixed
        data:
          fixed-version: 1.15.2-r0

  - id: CVE-2024-25630
    aliases:
      - GHSA-7496-fgv9-xw82
    events:
      - timestamp: 2024-04-26T08:43:17Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: 87ebb575655ff1dd
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-health-responder
            scanner: grype
      - timestamp: 2024-05-05T14:39:56Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.14.7).'

  - id: CVE-2024-25631
    aliases:
      - GHSA-x989-52fc-4vr4
    events:
      - timestamp: 2024-04-26T08:43:30Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: d2221a73b3cdff7d
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-sysctlfix
            scanner: grype
      - timestamp: 2024-05-05T14:39:57Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.14.7).'

  - id: CVE-2024-28180
    aliases:
      - GHSA-c5q2-7r4c-mv6g
    events:
      - timestamp: 2024-03-12T19:56:35Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15-operator-generic
            componentID: 7a6a51e54ff0af35
            componentName: github.com/go-jose/go-jose/v3
            componentVersion: v3.0.1
            componentType: go-module
            componentLocation: /usr/bin/cilium-operator-generic
            scanner: grype
      - timestamp: 2024-03-15T22:56:20Z
        type: fixed
        data:
          fixed-version: 1.15.2-r0

  - id: CVE-2024-28249
    aliases:
      - GHSA-j89h-qrvr-xc36
    events:
      - timestamp: 2024-04-26T08:43:24Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: 410d0ead0998c401
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-health
            scanner: grype
      - timestamp: 2024-05-04T16:36:56Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: 'A govulncheck analysis found that none of the known affected symbols were present in the APK, after examining the following paths within the package: /usr/bin/cilium-dbg, /usr/bin/cilium-health, /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-health-responder, /usr/bin/cilium-sysctlfix, /usr/bin/cilium-mount.'

  - id: GHSA-pfhr-pccp-hwmh
    events:
      - timestamp: 2024-04-26T08:43:26Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: 87ebb575655ff1dd
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-health-responder
            scanner: grype
      - timestamp: 2024-05-05T14:39:56Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.10.14).'

  - id: GHSA-wc5v-r48v-g4vh
    events:
      - timestamp: 2024-04-26T08:43:28Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: 87ebb575655ff1dd
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-health-responder
            scanner: grype
      - timestamp: 2024-05-05T14:39:57Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.10.13).'