Cilium v1.19 NetworkPolicy misconfiguration allows unintended ingress traffic

According to the GitHub Security Advisory database, Cilium versions v1.19.0 through v1.19.4 exhibit a vulnerability where Kubernetes NetworkPolicy configurations using `ipBlock` rules may inadvertently allow ingress traffic from other workloads in the same namespace. This occurs under specific cluster configurations where a custom `clusterName` is set, causing the parser to append a wildcard namespace label selector to Layer 3 rules. This behavior is unintended and can lead to security risks by permitting traffic that should be restricted.

Operators planning to upgrade to Cilium v1.19.5, which contains the patch for this issue, should first review their existing Kubernetes NetworkPolicy configurations. Specifically, they should identify any policies using `ipBlock` rules without pod or namespace selectors and assess whether these policies are unintentionally allowing ingress traffic from the local namespace. If such policies are in use, operators may need to transition to using CiliumNetworkPolicy with `fromCIDR` expressions as a workaround before upgrading. Additionally, they should confirm their cluster's `clusterName` setting, as the vulnerability is tied to non-default configurations of this parameter.