8

CVE-2024-28860

Insecure IPsec transport encryption in Cilium

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to chosen plaintext, key recovery, replay attacks by a man-in-the-middle attacker. These attacks are possible due to an ESP sequence number collision when multiple nodes are configured with the same key. Fixed versions of Cilium use unique keys for each IPsec tunnel established between nodes, resolving all of the above attacks. This vulnerability is fixed in 1.13.13, 1.14.9, and 1.15.3.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cilium ≫ Cilium Version >= 1.4.0 < 1.13.14
Cilium ≫ Cilium Version >= 1.14.0 < 1.14.9
Cilium ≫ Cilium Version >= 1.15.0 < 1.15.3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.068
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 1.6 5.2
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
security-advisories@github.com 8 1.6 5.8
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE-326 Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

https://docs.cilium.io/en/stable/security/network/encryption-ipsec
Product
https://github.com/cilium/cilium/commit/311fbce5280491cddceab178d83b06fa23688c72
Patch
https://github.com/cilium/cilium/commit/a1742b478306fa256cd27df1039dfae0537b4149
Patch
https://github.com/cilium/cilium/commit/a652c123331852cca90c74202f993d4170fd37fa
Patch
https://github.com/cilium/cilium/security/advisories/GHSA-pwqm-x5x6-5586
Third Party Advisory