Affected by GO-2023-2078
and 13 other vulnerabilities
GO-2023-2078 : Kubernetes users may update Pod labels to bypass network policy in github.com/cilium/cilium
GO-2023-2079 : Specific Cilium configurations vulnerable to DoS via Kubernetes annotations in github.com/cilium/cilium
GO-2023-2080 : Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy in github.com/cilium/cilium
GO-2024-2568 : Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium
GO-2024-2569 : Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium
GO-2024-2653 : HTTP policy bypass in github.com/cilium/cilium
GO-2024-2656 : Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium
GO-2024-2657 : Unencrypted traffic between nodes with WireGuard in github.com/cilium/cilium
GO-2024-2666 : Insecure IPsec transparent encryption in github.com/cilium/cilium
GO-2024-2922 : Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium
GO-2024-3072 : Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium
GO-2024-3208 : Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium
GO-2025-3415 : DoS in Cilium agent DNS proxy from crafted DNS responses in github.com/cilium/cilium
GO-2025-3416 : Cilium has an information leakage via insecure default Hubble UI CORS header in github.com/cilium/cilium
Discover Packages
github.com/cilium/cilium
plugins
cilium-cni
lib
package
Version:
v1.14.0
Opens a new window with list of versions in this module.
Published: Jul 27, 2023
License: Apache-2.0
Opens a new window with license information.
Imports: 11
Opens a new window with list of imports.
Imported by: 1
Opens a new window with list of known importers.
Documentation
Documentation
¶
type DeletionFallbackClient struct {
}
NewDeletionFallbackClient creates a client that will either issue an EndpointDelete
request via the api, *or* queue one in a temporary directory.
To prevent race conditions, the logic is:
1. Try and connect to the socket. if that succeeds, done
2. Otherwise, take a shared lock on the delete queue directory
3. Once we get the lock, check to see if the socket now exists
4. If it exists, drop the lock and use the api
EndpointDelete deletes an endpoint given by an endpoint id, either
by directly accessing the API or dropping in a queued-deletion file.
endpoint-id is a qualified endpoint reference, e.g. "container-id:XXXXXXX"
Source Files
¶
Click to show internal directories.
Click to hide internal directories.