CVE-2024-42487
Cilium's Gateway API route matching order contradicts specification
Reported by github_m · Published August 15, 2024
github.com/cilium/cilium is fixed in 1.16.1 and 1.15.8 (Go Modules)
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In the 1.15 branch prior to 1.15.8 and the 1.16 branch prior to 1.16.1, Gateway API HTTPRoutes and GRPCRoutes do not follow the match precedence specified in the Gateway API specification. In particular, request headers are matched before request methods, when the specification describes that the request methods must be respected before headers are matched. This could result in unexpected behaviour with security This issue is fixed in Cilium v1.15.8 and v1.16.1. There is no workaround for this issue.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/cilium/cilium | Go Modules | 1.16.1, 1.15.8 |
| hubble-ui | Chainguard | 0.13.1-r5 |
| hubble-ui | Wolfi | 0.13.1-r5 |
| cilium-1.15 | Chainguard | 1.15.19-r3 |
| cilium | Bitnami | 1.16.1 |
| hubble-ui-backend-fips | Chainguard | 0.13.1-r5 |
| cilium-cli | Chainguard | 0.16.15-r2 |
| hubble | Wolfi | 1.16.0-r1 |
| cilium | cilium | 1.15.8 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| cilium | cilium | = 1.16.0, >= 1.15.0, < 1.15.8 |
| chainguard | hubble-ui | 0 |
| wolfi | hubble-ui | 0 |
| chainguard | cilium-1.15 | 0 |
| chainguard | hubble-ui-backend-fips | 0 |
| chainguard | cilium-cli | 0 |
| wolfi | hubble | 0 |
| wolfi | cilium-1.16 | 0 |
| chainguard | cilium-1.16 | 0 |
| wolfi | cilium-1.15 | 0 |
| chainguard | cilium-fips-1.15 | 0 |
| wolfi | cilium-cli | 0 |
| github.com | cilium/cilium | 1.16.0, 1.15.0, 1.16.0 |
| chainguard | hubble-fips | 0 |
| chainguard | hubble-ui-backend | 0 |
| chainguard | cilium-fips-1.16 | 0 |
| cilium | cilium | 1.16.0, 1.15.0 |
| chainguard | hubble | 0 |
Timeline
- Aug 15, 2024 CVE Published
- Aug 15, 2024 CVE Updated
- Aug 16, 2024 EPSS Score (30 in total, the first dated here)
- Aug 16, 2024 PoC Published
- Oct 4, 2024 Coalition ESS Score (7 in total, the first dated here)
- Jan 6, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-42487
vulnetix vdb fixes CVE-2024-42487Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-42487/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/cilium/cilium/security/advisories/GHSA-qcm3-7879-xcww x_refsource_CONFIRM
- https://github.com/cilium/cilium/pull/34109 x_refsource_MISC
- https://github.com/cilium/cilium/commit/a3510fe4a92305822aa1a5e08cb6d6c873c8699a x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2024-42487 advisory
- https://github.com/advisories/GHSA-qcm3-7879-xcww advisory
- https://github.com/cilium/cilium/commit/d88772b9c29e370becbc4547cada6711d51edcde patch
- https://github.com/cilium/cilium/commit/fe42273566a943a0f3174c87b23a195c856b51d6 patch
- https://github.com/cilium/cilium url