CVE-2024-25631
Fixed in a distro release EPSS <1%CVSS 6.1
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and has been patched in Cilium v1.14.7. There is no workaround to this issue.
Products: cilium
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/cilium/cilium | 1.14.7 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cilium-1.14 | 1.14.19-r23 |
| Chainguard | cilium-1.14 | 1.14.7-r0 |
| Chainguard | cilium-1.14-clustermesh-apiserver | 1.14.19-r23 |
| Chainguard | cilium-1.14-container-init | 1.14.7-r0 |
| Chainguard | cilium-1.14-container-init | 1.14.19-r23 |
| Chainguard | cilium-1.14-container-init-compat | 1.14.7-r0 |
| Chainguard | cilium-1.14-container-init-compat | 1.14.19-r23 |
| Chainguard | cilium-1.14-hubble-relay | 1.14.7-r0 |
| Chainguard | cilium-1.14-hubble-relay | 1.14.19-r23 |
| Chainguard | cilium-1.14-iptables | 1.14.7-r0 |
| Chainguard | cilium-1.14-iptables | 1.14.19-r23 |
| Chainguard | cilium-1.14-operator-aws | 1.14.7-r0 |
| Chainguard | cilium-1.14-operator-aws | 1.14.19-r23 |
| Chainguard | cilium-1.14-operator-generic | 1.14.19-r23 |
| Chainguard | cilium-1.14-operator-generic | 1.14.7-r0 |
| Chainguard | cilium-1.15 | 0 |
| Chainguard | cilium-1.15-clustermesh-apiserver | 0 |
| Chainguard | cilium-1.15-container-init | 0 |
| Chainguard | cilium-1.15-container-init-compat | 0 |
| Chainguard | cilium-1.15-hubble-relay | 0 |
| Chainguard | cilium-1.15-iptables | 0 |
| Chainguard | cilium-1.15-operator-aws | 0 |
| Chainguard | cilium-1.15-operator-generic | 0 |
| Chainguard | cilium-fips-1.14 | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-clustermesh-apiserver | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-compat | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-container-init | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-container-init-compat | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-host-utils | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-hubble-relay | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-iptables | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-operator-aws | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-operator-azure | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-operator-generic | 1.14.19-r24 |
| Chainguard | cilium-fips-1.15 | 0 |
| Chainguard | cilium-fips-1.15-clustermesh-apiserver | 0 |
| Chainguard | cilium-fips-1.15-container-init | 0 |
| Chainguard | cilium-fips-1.15-container-init-compat | 0 |
| Chainguard | cilium-fips-1.15-host-utils | 0 |
| Chainguard | cilium-fips-1.15-hubble-relay | 0 |
| Chainguard | cilium-fips-1.15-operator-aws | 0 |
| Chainguard | cilium-fips-1.15-operator-azure | 0 |
| Chainguard | cilium-fips-1.15-operator-generic | 0 |
| Chainguard | hubble | 0.13.0-r0 |
| Chainguard | hubble-compat | 0.13.0-r0 |
| Chainguard | hubble-fips | 0.13.0-r0 |
| Chainguard | hubble-fips-compat | 0.13.0-r0 |
| Chainguard | hubble-ui-backend | 0.13.3-r1 |
| Wolfi | cilium-1.14 | 1.14.19-r23 |
| Wolfi | cilium-1.14 | 1.14.7-r0 |
| Wolfi | cilium-1.14-container-init | 1.14.7-r0 |
| Wolfi | cilium-1.14-container-init | 1.14.19-r23 |
| Wolfi | cilium-1.14-container-init-compat | 1.14.7-r0 |
| Wolfi | cilium-1.14-container-init-compat | 1.14.19-r23 |
| Wolfi | cilium-1.14-hubble-relay | 1.14.19-r23 |
| Wolfi | cilium-1.14-hubble-relay | 1.14.7-r0 |
| Wolfi | cilium-1.14-iptables | 1.14.19-r23 |
| Wolfi | cilium-1.14-iptables | 1.14.7-r0 |
| Wolfi | cilium-1.14-operator-aws | 1.14.7-r0 |
| Wolfi | cilium-1.14-operator-generic | 1.14.7-r0 |
| Wolfi | cilium-1.14-operator-generic | 1.14.19-r23 |
| Wolfi | cilium-1.15 | 0 |
| Wolfi | cilium-1.15-container-init | 0 |
| Wolfi | cilium-1.15-container-init-compat | 0 |
| Wolfi | cilium-1.15-hubble-relay | 0 |
| Wolfi | cilium-1.15-iptables | 0 |
| Wolfi | cilium-1.15-operator-aws | 0 |
| Wolfi | cilium-1.15-operator-generic | 0 |
| Wolfi | hubble | 0.13.0-r0 |
| Wolfi | hubble-compat | 0.13.0-r0 |
| Wolfi | hubble-ui-backend | 0.13.3-r1 |