PT-2024-35358 · Cilium · Cilium

Ferozsalam · Published 2024-11-25 · Updated 2025-09-03 · CVE-2024-52529

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Cilium versions 1.16.0 through 1.16.3

Description The issue arises when there is a Layer 3 policy with a port range and a Layer 7 policy with a port within the first policy's range. In such cases, the Layer 7 policy enforcement would not occur for the traffic selected by the Layer 7 policy. This affects users who use Cilium's port range functionality, introduced in Cilium v1.16. For example, if a Layer 3 policy allows traffic to ports 80 through 444 and a Layer 7 policy allows GET requests to the /public path on port 80, requests would be permitted to all HTTP paths on matching endpoints, rather than just GET requests to the /public path as intended.

Recommendations For versions 1.16.0 through 1.16.3, users are advised to upgrade to Cilium v1.16.4, which includes the patch for this issue. As a temporary workaround, users with network policies that match the pattern described above can work around the issue by rewriting any policies that use port ranges to individually specify the ports permitted for traffic.

Exploit

Fix

Missing Authorization

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-862

CWE-755

Related Identifiers

BIT-CILIUM-2024-52529

BIT-CILIUM-OPERATOR-2024-52529

BIT-HUBBLE-RELAY-2024-52529

CVE-2024-52529

GHSA-XG58-75QF-9R67

GO-2024-3290

OPENSUSE-SU-2024:14567-1

Affected Products

Cilium

References · 37

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52529.json · Exploit
• https://github.com/cilium/cilium/security/advisories/GHSA-xg58-75qf-9r67 · Patch
• https://github.com/cilium/cilium/pull/35150 · Patch
• https://osv.dev/vulnerability/BIT-hubble-relay-2024-52529 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52529 · Security Note
• https://osv.dev/vulnerability/GO-2024-3290 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52529 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-operator-2024-52529 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14567-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xg58-75qf-9r67 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-2024-52529 · Vendor Advisory
• https://github.com/cilium/cilium · Note
• https://suse.com/security/cve/CVE-2024-36620 · Note
• https://t.me/k8security/1380 · Telegram Post
• https://suse.com/security/cve/CVE-2024-6219 · Note