PT-2024-22363 · Cilium · Cilium

Romikps · Published 2024-03-18 · Updated 2025-01-09 · CVE-2024-28248

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cilium versions 1.13.9 through 1.13.12 Cilium versions 1.14.0 through 1.14.7 Cilium versions 1.15.0 through 1.15.1

Description Cilium's HTTP policies are not consistently applied to all traffic in the scope of the policies, leading to HTTP traffic being incorrectly and intermittently forwarded when it should be dropped.

Recommendations For Cilium versions 1.13.9 through 1.13.12, update to version 1.13.13 to resolve the issue. For Cilium versions 1.14.0 through 1.14.7, update to version 1.14.8 to resolve the issue. For Cilium versions 1.15.0 through 1.15.1, update to version 1.15.2 to resolve the issue.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

BIT-CILIUM-2024-28248

BIT-CILIUM-OPERATOR-2024-28248

BIT-CILIUM-PROXY-2024-28248

BIT-HUBBLE-2024-28248

BIT-HUBBLE-RELAY-2024-28248

BIT-HUBBLE-UI-2024-28248

BIT-HUBBLE-UI-BACKEND-2024-28248

CVE-2024-28248

GHSA-68MJ-9PJQ-MC85

GO-2024-2653

Affected Products

Cilium

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28248.json · Exploit
• https://github.com/cilium/cilium/security/advisories/GHSA-68mj-9pjq-mc85 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-2024-28248 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hubble-ui-2024-28248 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-proxy-2024-28248 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28248 · Security Note
• https://osv.dev/vulnerability/BIT-cilium-operator-2024-28248 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-68mj-9pjq-mc85 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hubble-2024-28248 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hubble-relay-2024-28248 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28248 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hubble-ui-backend-2024-28248 · Vendor Advisory
• https://github.com/cilium/cilium · Note
• https://github.com/cilium/cilium/releases/tag/v1.15.2 · Note