Log in Start free

Vulnerability · Published Mar 18, 2024 · Assigned by GitHub_M

CVE-2024-28250Cilium has possible unencrypted traffic between nodes when using WireGuard and L7 policies

Medium 6.1

In plain English

A medium-severity security flaw in cilium from cilium. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.2%top 93.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.8 and 1.15.2, In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies Wireguard-eligible traffic that is sent between a node's Envoy proxy and pods on other nodes is sent unencrypted and Wireguard-eligible traffic that is sent between a node's DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.14.8 and 1.15.2 in in native routing mode (`routingMode=native`) and in Cilium 1.14.4 in tunneling mode (`routingMode=tunnel`). Not that in tunneling mode, `encryption.wireguard.encapsulate` must be set to `true`. There is no known workaround for this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/cilium/cilium1.14.8GHSA-v6q2-4qr3-5cw6
Gogithub.com/cilium/cilium1.15.2GHSA-v6q2-4qr3-5cw6
Gogithub.com/cilium/cilium1.14.8, 1.15.2GO-2024-2657

Affected products (as reported)

VendorProductVersions
cilium cilium >= 1.14.0, < 1.14.8>= 1.15.0, < 1.15.2

Weakness: CWE-311 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References