Riskcovery

CVE-2024-28249

Cilium has possible unencrypted traffic between nodes when using IPsec and L7 policies

State
Published
Severity
6.1 Medium
Published
Mar 18, 2024
Updated
Aug 2, 2024
Reserved
Mar 7, 2024

Read the record on cve.org

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node's Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node's DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue.

Scores

CVSSScoreVectorSource
3.16.1 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:NGitHub_M

Weaknesses

  • CWE-311 Missing Encryption of Sensitive Data

Affected Products

ProductVersions
ciliumcilium
  • < 1.13.13Affected
  • >= 1.14.0, < 1.14.8Affected
  • >= 1.15.0, < 1.15.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.