5.5

CVE-2025-64715

Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicys which use egress.toGroups.aws.securityGroupsIds to reference AWS security group IDs that do not exist or are not attached to any network interface may unintentionally allow broader outbound access than intended by the policy authors. In such cases, the toCIDRset section of the derived policy is not generated, which means outbound traffic may be permitted to more destinations than originally intended. This issue has been patched in versions 1.16.17, 1.17.10, and 1.18.4. There are no workarounds for this issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cilium ≫ Cilium Version < 1.16.17
Cilium ≫ Cilium Version >= 1.17.0 < 1.17.10
Cilium ≫ Cilium Version >= 1.18.0 < 1.18.4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.053
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
security-advisories@github.com 4 2.5 1.4
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://github.com/cilium/cilium/security/advisories/GHSA-38pp-6gcp-rqvm
Patch
Vendor Advisory
https://github.com/cilium/cilium/commit/a385856b59c8289cc7273fa3a3062bbf0ef96c97
Patch
https://github.com/cilium/cilium/releases/tag/v1.16.17
Release Notes
https://github.com/cilium/cilium/releases/tag/v1.17.10
Release Notes
https://github.com/cilium/cilium/releases/tag/v1.18.4
Release Notes