cvelistv5 - CVE-2024-28249

CVE-2024-28249 (GCVE-0-2024-28249)

Vulnerability from cvelistv5 – Published: 2024-03-18 21:36 – Updated: 2024-08-02 00:48

Summary

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node's Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node's DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue.

Severity ?

6.1 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

CWE

CWE-311 - Missing Encryption of Sensitive Data

Assigner

GitHub_M

References

URL

Tags

	https://github.com/cilium/cilium/security/advisor…	x_refsource_CONFIRM
	https://github.com/cilium/cilium/releases/tag/v1.13.13	x_refsource_MISC
	https://github.com/cilium/cilium/releases/tag/v1.14.8	x_refsource_MISC
	https://github.com/cilium/cilium/releases/tag/v1.15.2	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	cilium	cilium	Affected: < 1.13.13 Affected: >= 1.14.0, < 1.14.8 Affected: >= 1.15.0, < 1.15.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-28249",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-19T14:34:32.978403Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T18:03:57.880Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:48:49.660Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36"
          },
          {
            "name": "https://github.com/cilium/cilium/releases/tag/v1.13.13",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/cilium/cilium/releases/tag/v1.13.13"
          },
          {
            "name": "https://github.com/cilium/cilium/releases/tag/v1.14.8",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/cilium/cilium/releases/tag/v1.14.8"
          },
          {
            "name": "https://github.com/cilium/cilium/releases/tag/v1.15.2",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/cilium/cilium/releases/tag/v1.15.2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cilium",
          "vendor": "cilium",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.14.0, \u003c 1.14.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.15.0, \u003c 1.15.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node\u0027s Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node\u0027s DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-311",
              "description": "CWE-311: Missing Encryption of Sensitive Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T21:36:10.510Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36"
        },
        {
          "name": "https://github.com/cilium/cilium/releases/tag/v1.13.13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cilium/cilium/releases/tag/v1.13.13"
        },
        {
          "name": "https://github.com/cilium/cilium/releases/tag/v1.14.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cilium/cilium/releases/tag/v1.14.8"
        },
        {
          "name": "https://github.com/cilium/cilium/releases/tag/v1.15.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cilium/cilium/releases/tag/v1.15.2"
        }
      ],
      "source": {
        "advisory": "GHSA-j89h-qrvr-xc36",
        "discovery": "UNKNOWN"
      },
      "title": "Cilium has possible unencrypted traffic between nodes when using IPsec and L7 policies"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-28249",
    "datePublished": "2024-03-18T21:36:10.510Z",
    "dateReserved": "2024-03-07T14:33:30.036Z",
    "dateUpdated": "2024-08-02T00:48:49.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.13.13\", \"matchCriteriaId\": \"7ED07032-14A2-48C9-AE92-68A5E05DBA58\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.14.0\", \"versionEndExcluding\": \"1.14.8\", \"matchCriteriaId\": \"50C01BB2-3804-450F-846D-DE7A23112DF6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.15.0\", \"versionEndExcluding\": \"1.15.2\", \"matchCriteriaId\": \"9938037D-85A4-4964-B593-33015AEFC8DB\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node\u0027s Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node\u0027s DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue.\"}, {\"lang\": \"es\", \"value\": \"Cilium es una soluci\\u00f3n de redes, observabilidad y seguridad con un plano de datos basado en eBPF. Antes de las versiones 1.13.13, 1.14.8 y 1.15.2, en los cl\\u00fasteres de Cilium con IPsec habilitado y el tr\\u00e1fico que coincide con las pol\\u00edticas de Capa 7, el tr\\u00e1fico elegible para IPsec entre el proxy Envoy de un nodo y los pods en otros nodos se env\\u00eda sin cifrar y es elegible para IPsec. El tr\\u00e1fico entre el proxy DNS de un nodo y los pods de otros nodos se env\\u00eda sin cifrar. Este problema se resolvi\\u00f3 en Cilium 1.15.2, 1.14.8 y 1.13.13. No se conoce ning\\u00fan workaround para este problema.\"}]",
      "id": "CVE-2024-28249",
      "lastModified": "2025-01-09T16:46:53.507",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.6, \"impactScore\": 4.0}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.6, \"impactScore\": 4.0}]}",
      "published": "2024-03-18T22:15:08.503",
      "references": "[{\"url\": \"https://github.com/cilium/cilium/releases/tag/v1.13.13\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://github.com/cilium/cilium/releases/tag/v1.14.8\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://github.com/cilium/cilium/releases/tag/v1.15.2\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://github.com/cilium/cilium/releases/tag/v1.13.13\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://github.com/cilium/cilium/releases/tag/v1.14.8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://github.com/cilium/cilium/releases/tag/v1.15.2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\"]}, {\"url\": \"https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-311\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-319\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-28249\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-03-18T22:15:08.503\",\"lastModified\":\"2025-01-09T16:46:53.507\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node\u0027s Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node\u0027s DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue.\"},{\"lang\":\"es\",\"value\":\"Cilium es una soluci\u00f3n de redes, observabilidad y seguridad con un plano de datos basado en eBPF. Antes de las versiones 1.13.13, 1.14.8 y 1.15.2, en los cl\u00fasteres de Cilium con IPsec habilitado y el tr\u00e1fico que coincide con las pol\u00edticas de Capa 7, el tr\u00e1fico elegible para IPsec entre el proxy Envoy de un nodo y los pods en otros nodos se env\u00eda sin cifrar y es elegible para IPsec. El tr\u00e1fico entre el proxy DNS de un nodo y los pods de otros nodos se env\u00eda sin cifrar. Este problema se resolvi\u00f3 en Cilium 1.15.2, 1.14.8 y 1.13.13. No se conoce ning\u00fan workaround para este problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":4.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":4.0}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-311\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-319\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.13.13\",\"matchCriteriaId\":\"7ED07032-14A2-48C9-AE92-68A5E05DBA58\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.14.0\",\"versionEndExcluding\":\"1.14.8\",\"matchCriteriaId\":\"50C01BB2-3804-450F-846D-DE7A23112DF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.15.0\",\"versionEndExcluding\":\"1.15.2\",\"matchCriteriaId\":\"9938037D-85A4-4964-B593-33015AEFC8DB\"}]}]}],\"references\":[{\"url\":\"https://github.com/cilium/cilium/releases/tag/v1.13.13\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/cilium/cilium/releases/tag/v1.14.8\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/cilium/cilium/releases/tag/v1.15.2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/cilium/cilium/releases/tag/v1.13.13\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/cilium/cilium/releases/tag/v1.14.8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/cilium/cilium/releases/tag/v1.15.2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Cilium has possible unencrypted traffic between nodes when using IPsec and L7 policies\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-311\", \"lang\": \"en\", \"description\": \"CWE-311: Missing Encryption of Sensitive Data\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"ADJACENT_NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36\"}, {\"name\": \"https://github.com/cilium/cilium/releases/tag/v1.13.13\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/cilium/cilium/releases/tag/v1.13.13\"}, {\"name\": \"https://github.com/cilium/cilium/releases/tag/v1.14.8\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/cilium/cilium/releases/tag/v1.14.8\"}, {\"name\": \"https://github.com/cilium/cilium/releases/tag/v1.15.2\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/cilium/cilium/releases/tag/v1.15.2\"}], \"affected\": [{\"vendor\": \"cilium\", \"product\": \"cilium\", \"versions\": [{\"version\": \"\u003c 1.13.13\", \"status\": \"affected\"}, {\"version\": \"\u003e= 1.14.0, \u003c 1.14.8\", \"status\": \"affected\"}, {\"version\": \"\u003e= 1.15.0, \u003c 1.15.2\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-03-18T21:36:10.510Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node\u0027s Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node\u0027s DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue.\"}], \"source\": {\"advisory\": \"GHSA-j89h-qrvr-xc36\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-28249\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-03-19T14:34:32.978403Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:18.629Z\"}, \"title\": \"CISA ADP Vulnrichment\"}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-28249\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2024-03-07T14:33:30.036Z\", \"datePublished\": \"2024-03-18T21:36:10.510Z\", \"dateUpdated\": \"2024-06-04T18:03:57.880Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-28249

Vulnerability from fkie_nvd - Published: 2024-03-18 22:15 - Updated: 2025-01-09 16:46

Severity ?

6.1 (Medium) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
6.1 (Medium) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/cilium/cilium/releases/tag/v1.13.13	Release Notes
security-advisories@github.com	https://github.com/cilium/cilium/releases/tag/v1.14.8	Release Notes
security-advisories@github.com	https://github.com/cilium/cilium/releases/tag/v1.15.2	Release Notes
security-advisories@github.com	https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/cilium/cilium/releases/tag/v1.13.13	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/cilium/cilium/releases/tag/v1.14.8	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/cilium/cilium/releases/tag/v1.15.2	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36	Vendor Advisory

Impacted products

Vendor	Product	Version
cilium	cilium	*
cilium	cilium	*
cilium	cilium	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7ED07032-14A2-48C9-AE92-68A5E05DBA58",
              "versionEndExcluding": "1.13.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "50C01BB2-3804-450F-846D-DE7A23112DF6",
              "versionEndExcluding": "1.14.8",
              "versionStartIncluding": "1.14.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9938037D-85A4-4964-B593-33015AEFC8DB",
              "versionEndExcluding": "1.15.2",
              "versionStartIncluding": "1.15.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node\u0027s Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node\u0027s DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue."
    },
    {
      "lang": "es",
      "value": "Cilium es una soluci\u00f3n de redes, observabilidad y seguridad con un plano de datos basado en eBPF. Antes de las versiones 1.13.13, 1.14.8 y 1.15.2, en los cl\u00fasteres de Cilium con IPsec habilitado y el tr\u00e1fico que coincide con las pol\u00edticas de Capa 7, el tr\u00e1fico elegible para IPsec entre el proxy Envoy de un nodo y los pods en otros nodos se env\u00eda sin cifrar y es elegible para IPsec. El tr\u00e1fico entre el proxy DNS de un nodo y los pods de otros nodos se env\u00eda sin cifrar. Este problema se resolvi\u00f3 en Cilium 1.15.2, 1.14.8 y 1.13.13. No se conoce ning\u00fan workaround para este problema."
    }
  ],
  "id": "CVE-2024-28249",
  "lastModified": "2025-01-09T16:46:53.507",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-03-18T22:15:08.503",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/cilium/cilium/releases/tag/v1.13.13"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/cilium/cilium/releases/tag/v1.14.8"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/cilium/cilium/releases/tag/v1.15.2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/cilium/cilium/releases/tag/v1.13.13"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/cilium/cilium/releases/tag/v1.14.8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/cilium/cilium/releases/tag/v1.15.2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-311"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-319"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GSD-2024-28249

Vulnerability from gsd - Updated: 2024-03-08 06:02

Details

Aliases

CVE-2024-28249

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-28249"
      ],
      "details": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node\u0027s Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node\u0027s DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue.",
      "id": "GSD-2024-28249",
      "modified": "2024-03-08T06:02:46.520116Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2024-28249",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "cilium",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003c 1.13.13"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 1.14.0, \u003c 1.14.8"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 1.15.0, \u003c 1.15.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "cilium"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node\u0027s Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node\u0027s DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-311",
                "lang": "eng",
                "value": "CWE-311: Missing Encryption of Sensitive Data"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36",
            "refsource": "MISC",
            "url": "https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36"
          },
          {
            "name": "https://github.com/cilium/cilium/releases/tag/v1.13.13",
            "refsource": "MISC",
            "url": "https://github.com/cilium/cilium/releases/tag/v1.13.13"
          },
          {
            "name": "https://github.com/cilium/cilium/releases/tag/v1.14.8",
            "refsource": "MISC",
            "url": "https://github.com/cilium/cilium/releases/tag/v1.14.8"
          },
          {
            "name": "https://github.com/cilium/cilium/releases/tag/v1.15.2",
            "refsource": "MISC",
            "url": "https://github.com/cilium/cilium/releases/tag/v1.15.2"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-j89h-qrvr-xc36",
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node\u0027s Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node\u0027s DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue."
          },
          {
            "lang": "es",
            "value": "Cilium es una soluci\u00f3n de redes, observabilidad y seguridad con un plano de datos basado en eBPF. Antes de las versiones 1.13.13, 1.14.8 y 1.15.2, en los cl\u00fasteres de Cilium con IPsec habilitado y el tr\u00e1fico que coincide con las pol\u00edticas de Capa 7, el tr\u00e1fico elegible para IPsec entre el proxy Envoy de un nodo y los pods en otros nodos se env\u00eda sin cifrar y es elegible para IPsec. El tr\u00e1fico entre el proxy DNS de un nodo y los pods de otros nodos se env\u00eda sin cifrar. Este problema se resolvi\u00f3 en Cilium 1.15.2, 1.14.8 y 1.13.13. No se conoce ning\u00fan workaround para este problema."
          }
        ],
        "id": "CVE-2024-28249",
        "lastModified": "2024-03-19T13:26:46.000",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-03-18T22:15:08.503",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/cilium/cilium/releases/tag/v1.13.13"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/cilium/cilium/releases/tag/v1.14.8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/cilium/cilium/releases/tag/v1.15.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-311"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

GHSA-J89H-QRVR-XC36

Vulnerability from github – Published: 2024-03-18 20:30 – Updated: 2024-03-19 18:31

Summary

Unencrypted traffic between nodes when using IPsec and L7 policies

Details

Impact

In Cilium clusters with IPsec enabled and traffic matching Layer 7 policies:

Traffic that should be IPsec-encrypted between a node's Envoy proxy and pods on other nodes is sent unencrypted
Traffic that should be IPsec-encrypted between a node's DNS proxy and pods on other nodes is sent unencrypted

Note: For clusters running in native routing mode, IPsec encryption is not applied to connections which are selected by a L7 Egress Network Policy or a DNS Policy. This is a known limitation of Cilium's IPsec encryption which will continue to apply after upgrading to the latest Cilium versions described below.

Patches

This issue affects:

Cilium v1.15 before v1.15.2
Cilium v1.14 before v1.14.8
Cilium v1.13 before v1.13.13
Cilium v1.4 to v1.12 inclusive

This issue has been resolved in:

Cilium v1.15.2
Cilium v1.14.8
Cilium v1.13.13

Workarounds

There is no workaround to this issue.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @jschwinger233, @julianwiedmann, @giorio94, and @jrajahalme for their work in triaging and resolving this issue.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

If you think you have found a vulnerability in Cilium, we strongly encourage you to report it to our private security mailing list at security@cilium.io. This is a private mailing list that only members of the Cilium internal security team are subscribed to, and your report will be treated as top priority.

Severity ?

6.1 (Medium)


                  
                    CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cilium/cilium"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cilium/cilium"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.14.0"
            },
            {
              "fixed": "1.14.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cilium/cilium"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.15.0"
            },
            {
              "fixed": "1.15.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-28249"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-311",
      "CWE-319"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-18T20:30:41Z",
    "nvd_published_at": "2024-03-18T22:15:08Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nIn Cilium clusters with IPsec enabled and traffic matching Layer 7 policies:\n\n- Traffic that should be IPsec-encrypted between a node\u0027s Envoy proxy and pods on other nodes is sent unencrypted\n- Traffic that should be IPsec-encrypted between a node\u0027s DNS proxy and pods on other nodes is sent unencrypted\n\n**Note:** For clusters running in native routing mode, IPsec encryption is not applied to connections which are selected by a L7 Egress Network Policy or a DNS Policy. This is a known limitation of Cilium\u0027s IPsec encryption which will continue to apply after upgrading to the latest Cilium versions described below.\n\n### Patches\n\nThis issue affects: \n\n- Cilium v1.15 before v1.15.2\n- Cilium v1.14 before v1.14.8\n- Cilium v1.13 before v1.13.13\n- Cilium v1.4 to v1.12 inclusive\n\nThis issue has been resolved in:\n\n- Cilium v1.15.2\n-  Cilium v1.14.8\n-  Cilium v1.13.13\n\n### Workarounds\nThere is no workaround to this issue.\n\n### Acknowledgements\nThe Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @jschwinger233, @julianwiedmann, @giorio94, and @jrajahalme for their work in triaging and resolving this issue.   \n\n### For more information\nIf you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).\n\nIf you think you have found a vulnerability in Cilium, we strongly encourage you to report it to our private security mailing list at [security@cilium.io](mailto:security@cilium.io). This is a private mailing list that only members of the Cilium internal security team are subscribed to, and your report will be treated as top priority.",
  "id": "GHSA-j89h-qrvr-xc36",
  "modified": "2024-03-19T18:31:22Z",
  "published": "2024-03-18T20:30:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28249"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cilium/cilium"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cilium/cilium/releases/tag/v1.13.13"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cilium/cilium/releases/tag/v1.14.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cilium/cilium/releases/tag/v1.15.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Unencrypted traffic between nodes when using IPsec and L7 policies"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-28249 (GCVE-0-2024-28249)

FKIE_CVE-2024-28249

GSD-2024-28249

GHSA-J89H-QRVR-XC36

Impact

Patches

Workarounds

Acknowledgements

For more information

Tags

Sightings

Nomenclature