PT-2024-22366 · Cilium · Cilium

Giorio94 · Published 2024-03-18 · Updated 2025-01-09 · CVE-2024-28250

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cilium versions 1.14.0 through 1.14.7 Cilium versions 1.15.0 through 1.15.1 Cilium version 1.14.4 with encryption.wireguard.encapsulate set to false in tunneling mode

Description In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies, WireGuard-eligible traffic sent between a node's Envoy proxy and pods on other nodes is sent unencrypted, and WireGuard-eligible traffic sent between a node's DNS proxy and pods on other nodes is sent unencrypted.

Recommendations For Cilium versions 1.14.0 through 1.14.7, update to version 1.14.8 or later in native routing mode. For Cilium versions 1.15.0 through 1.15.1, update to version 1.15.2 or later in native routing mode. For Cilium version 1.14.4 in tunneling mode, set encryption.wireguard.encapsulate to true to resolve the issue. There is no known workaround for this issue.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-319

CWE-311

Related Identifiers

BIT-CILIUM-2024-28250

BIT-CILIUM-OPERATOR-2024-28250

BIT-CILIUM-PROXY-2024-28250

BIT-HUBBLE-2024-28250

BIT-HUBBLE-RELAY-2024-28250

BIT-HUBBLE-UI-2024-28250

BIT-HUBBLE-UI-BACKEND-2024-28250

CVE-2024-28250

GHSA-V6Q2-4QR3-5CW6

GO-2024-2657

Affected Products

Cilium

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28250.json · Exploit
• https://github.com/cilium/cilium/security/advisories/GHSA-v6q2-4qr3-5cw6 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hubble-2024-28250 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-2024-28250 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hubble-ui-2024-28250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28250 · Security Note
• https://osv.dev/vulnerability/GHSA-v6q2-4qr3-5cw6 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-operator-2024-28250 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hubble-ui-backend-2024-28250 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28250 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hubble-relay-2024-28250 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-proxy-2024-28250 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2657 · Vendor Advisory
• https://github.com/cilium/cilium · Note
• https://github.com/cilium/cilium/releases/tag/v1.15.2 · Note