cilium-1.15.advisories.yaml

schema-version: 2.0.2

package:
  name: cilium-1.15

advisories:
  - id: CGA-22c8-mrmm-4hq4
    aliases:
      - CVE-2022-29179
      - GHSA-fmrf-gvjp-5j5g
    events:
      - timestamp: 2024-04-26T08:43:20Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: df49fa420728224d
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /opt/cni/bin/cilium-cni
            scanner: grype
      - timestamp: 2024-05-05T14:39:56Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.9.16).'

  - id: CGA-2344-g9wr-qvj7
    aliases:
      - CVE-2023-27594
      - GHSA-8fg8-jh2h-f2hc
    events:
      - timestamp: 2024-04-26T08:43:18Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: d2221a73b3cdff7d
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-sysctlfix
            scanner: grype
      - timestamp: 2024-05-05T14:39:56Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.11.15).'

  - id: CGA-3wq2-gh42-69pw
    aliases:
      - CVE-2024-25630
      - GHSA-7496-fgv9-xw82
    events:
      - timestamp: 2024-04-26T08:43:17Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: 87ebb575655ff1dd
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-health-responder
            scanner: grype
      - timestamp: 2024-05-05T14:39:56Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.14.7).'

  - id: CGA-4p72-h9hg-87c6
    aliases:
      - CVE-2023-41333
      - GHSA-4xp2-w642-7mcx
    events:
      - timestamp: 2024-04-26T08:43:14Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: 87ebb575655ff1dd
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-health-responder
            scanner: grype
      - timestamp: 2024-05-05T14:39:54Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.12.14).'

  - id: CGA-59w7-j78w-7pxh
    aliases:
      - GHSA-wc5v-r48v-g4vh
    events:
      - timestamp: 2024-04-26T08:43:28Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: 87ebb575655ff1dd
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-health-responder
            scanner: grype
      - timestamp: 2024-05-05T14:39:57Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.10.13).'

  - id: CGA-6c39-g8w9-r3qp
    aliases:
      - CVE-2022-29178
      - GHSA-6p8v-8cq8-v2r3
    events:
      - timestamp: 2024-04-26T08:43:15Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: 835185c6e9895d51
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-dbg
            scanner: grype
      - timestamp: 2024-05-05T14:39:55Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.9.16).'

  - id: CGA-8323-hjcv-87gc
    aliases:
      - CVE-2024-24789
      - GHSA-236w-p7wf-5ph8
    events:
      - timestamp: 2024-06-07T12:02:49Z
        type: fixed
        data:
          fixed-version: 1.15.5-r1

  - id: CGA-92h8-mvm8-r4qh
    aliases:
      - CVE-2023-45288
      - GHSA-4v7x-pqxf-cx7m
    events:
      - timestamp: 2024-04-20T12:24:02Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15-hubble-relay
            componentID: 7ba8f00b9fe43798
            componentName: golang.org/x/net
            componentVersion: v0.20.0
            componentType: go-module
            componentLocation: /usr/bin/hubble-relay
            scanner: grype
      - timestamp: 2024-05-04T16:36:53Z
        type: true-positive-determination
        data:
          note: A govulncheck analysis found the several affected symbols in the APK.
      - timestamp: 2024-05-21T17:19:01Z
        type: fixed
        data:
          fixed-version: 1.15.5-r0

  - id: CGA-9w68-jxr8-pm5g
    aliases:
      - CVE-2024-25631
      - GHSA-x989-52fc-4vr4
    events:
      - timestamp: 2024-04-26T08:43:30Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: d2221a73b3cdff7d
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-sysctlfix
            scanner: grype
      - timestamp: 2024-05-05T14:39:57Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.14.7).'

  - id: CGA-j5xm-929f-73rq
    aliases:
      - CVE-2023-30851
      - GHSA-2h44-x2wx-49f4
    events:
      - timestamp: 2024-04-26T08:43:12Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: 9687b3fc05fc198d
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-bugtool
            scanner: grype
      - timestamp: 2024-05-05T14:39:53Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.11.16).'

  - id: CGA-m5w8-wjm6-68f7
    aliases:
      - GHSA-pfhr-pccp-hwmh
    events:
      - timestamp: 2024-04-26T08:43:26Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: 87ebb575655ff1dd
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-health-responder
            scanner: grype
      - timestamp: 2024-05-05T14:39:56Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.10.14).'

  - id: CGA-m7f8-fxh8-x9rm
    aliases:
      - CVE-2024-24791
      - GHSA-hw49-2p59-3mhj
    events:
      - timestamp: 2024-07-04T07:39:42Z
        type: fixed
        data:
          fixed-version: 1.15.6-r1

  - id: CGA-mcr5-hfq3-g797
    aliases:
      - CVE-2024-24790
      - GHSA-49gw-vxvf-fc2g
    events:
      - timestamp: 2024-06-07T12:02:53Z
        type: fixed
        data:
          fixed-version: 1.15.5-r1

  - id: CGA-mjm2-fcw2-75h7
    aliases:
      - GHSA-xr7q-jx4m-x55m
    events:
      - timestamp: 2024-07-10T08:12:47Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: fbee7fffda4a08d2
            componentName: google.golang.org/grpc
            componentVersion: v1.64.0
            componentType: go-module
            componentLocation: /usr/lib/libcilium.so
            scanner: grype
      - timestamp: 2024-07-10T19:30:33Z
        type: fixed
        data:
          fixed-version: 1.15.6-r2

  - id: CGA-p93g-c4c7-2hf8
    aliases:
      - CVE-2023-41332
      - GHSA-24m5-r6hv-ccgp
    events:
      - timestamp: 2024-04-26T08:43:10Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: baf534dc6a830d5e
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-mount
            scanner: grype
      - timestamp: 2024-05-05T14:39:52Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.12.14).'

  - id: CGA-pg67-h84j-9mwj
    aliases:
      - CVE-2024-24786
      - GHSA-8r3f-844c-mc37
    events:
      - timestamp: 2024-03-14T07:05:34Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15-hubble-relay
            componentID: 778db702fe4c97c6
            componentName: google.golang.org/protobuf
            componentVersion: v1.31.0
            componentType: go-module
            componentLocation: /usr/bin/hubble-relay
            scanner: grype
      - timestamp: 2024-03-15T22:56:26Z
        type: fixed
        data:
          fixed-version: 1.15.2-r0

  - id: CGA-pqp4-rcvv-jvgj
    aliases:
      - CVE-2024-37307
      - GHSA-wh78-7948-358j
    events:
      - timestamp: 2024-06-15T07:27:06Z
        type: fixed
        data:
          fixed-version: 1.15.6-r0

  - id: CGA-q47q-grmx-xgqp
    aliases:
      - CVE-2023-39347
      - GHSA-gj2r-phwg-6rww
    events:
      - timestamp: 2024-04-26T08:43:22Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: 410d0ead0998c401
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-health
            scanner: grype
      - timestamp: 2024-05-05T14:39:56Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.12.14).'

  - id: CGA-qqrq-h844-mrh5
    aliases:
      - CVE-2024-28249
      - GHSA-j89h-qrvr-xc36
    events:
      - timestamp: 2024-04-26T08:43:24Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: 410d0ead0998c401
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-health
            scanner: grype
      - timestamp: 2024-05-04T16:36:56Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: 'A govulncheck analysis found that none of the known affected symbols were present in the APK, after examining the following paths within the package: /usr/bin/cilium-dbg, /usr/bin/cilium-health, /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-health-responder, /usr/bin/cilium-sysctlfix, /usr/bin/cilium-mount.'

  - id: CGA-rw35-6m7p-47pr
    aliases:
      - CVE-2023-27593
      - GHSA-4hc4-pgfx-3mrx
    events:
      - timestamp: 2024-04-26T08:43:13Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15
            componentID: d2221a73b3cdff7d
            componentName: github.com/cilium/cilium
            componentVersion: v0.0.0-20240411222109-9b3f9a8c0d71
            componentType: go-module
            componentLocation: /usr/bin/cilium-sysctlfix
            scanner: grype
      - timestamp: 2024-05-05T14:39:53Z
        type: false-positive-determination
        data:
          type: vulnerable-code-version-not-used
          note: 'This vulnerability was matched to the module "github.com/cilium/cilium" at the following location(s): /opt/cni/bin/cilium-cni, /usr/bin/cilium-agent, /usr/bin/cilium-bugtool, /usr/bin/cilium-dbg, /usr/bin/cilium-health, /usr/bin/cilium-health-responder, /usr/bin/cilium-mount, /usr/bin/cilium-sysctlfix. In all cases, the installed version of the module (git commit 9b3f9a8c0d71bf70bc0fd3fbc256bacc67fe6c32) corresponds to a version tag (1.15.4) that is later than the fixed version (1.11.15).'

  - id: CGA-w757-x8qm-rww7
    aliases:
      - CVE-2024-28180
      - GHSA-c5q2-7r4c-mv6g
    events:
      - timestamp: 2024-03-12T19:56:35Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: cilium-1.15-operator-generic
            componentID: 7a6a51e54ff0af35
            componentName: github.com/go-jose/go-jose/v3
            componentVersion: v3.0.1
            componentType: go-module
            componentLocation: /usr/bin/cilium-operator-generic
            scanner: grype
      - timestamp: 2024-03-15T22:56:20Z
        type: fixed
        data:
          fixed-version: 1.15.2-r0