6.1

CVE-2024-28249

Cilium has possible unencrypted traffic between nodes when using IPsec and L7 policies

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node's Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node's DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cilium ≫ Cilium Version < 1.13.13
Cilium ≫ Cilium Version >= 1.14.0 < 1.14.8
Cilium ≫ Cilium Version >= 1.15.0 < 1.15.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.184
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 1.6 4
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
security-advisories@github.com 6.1 1.6 4
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
CWE-311 Missing Encryption of Sensitive Data

The product does not encrypt sensitive or critical information before storage or transmission.

CWE-319 Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

https://github.com/cilium/cilium/releases/tag/v1.13.13
Release Notes
https://github.com/cilium/cilium/releases/tag/v1.14.8
Release Notes
https://github.com/cilium/cilium/releases/tag/v1.15.2
Release Notes
https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36
Vendor Advisory