CVE-2024-28249
Fixed in a distro release EPSS <1%CVSS 6.1
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node's Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node's DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue.
Products: cilium
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/cilium/cilium | 1.13.13 |
| Go | github.com/cilium/cilium | 1.14.8 |
| Go | github.com/cilium/cilium | 1.15.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cilium-1.14 | 1.14.19-r23 |
| Chainguard | cilium-1.14 | 1.14.19-r34 |
| Chainguard | cilium-1.14-clustermesh-apiserver | 1.14.19-r34 |
| Chainguard | cilium-1.14-container-init | 1.14.19-r34 |
| Chainguard | cilium-1.14-container-init | 1.14.19-r23 |
| Chainguard | cilium-1.14-container-init-compat | 1.14.19-r34 |
| Chainguard | cilium-1.14-container-init-compat | 1.14.19-r23 |
| Chainguard | cilium-1.14-hubble-relay | 1.14.19-r23 |
| Chainguard | cilium-1.14-hubble-relay | 1.14.19-r34 |
| Chainguard | cilium-1.14-iptables | 1.14.19-r23 |
| Chainguard | cilium-1.14-iptables | 1.14.19-r34 |
| Chainguard | cilium-1.14-operator-aws | 1.14.19-r34 |
| Chainguard | cilium-1.14-operator-aws | 1.14.19-r23 |
| Chainguard | cilium-1.14-operator-generic | 1.14.19-r23 |
| Chainguard | cilium-1.14-operator-generic | 1.14.19-r34 |
| Chainguard | cilium-1.15 | 0 |
| Chainguard | cilium-1.15-clustermesh-apiserver | 0 |
| Chainguard | cilium-1.15-container-init | 0 |
| Chainguard | cilium-1.15-container-init-compat | 0 |
| Chainguard | cilium-1.15-hubble-relay | 0 |
| Chainguard | cilium-1.15-iptables | 0 |
| Chainguard | cilium-1.15-operator-aws | 0 |
| Chainguard | cilium-1.15-operator-generic | 0 |
| Chainguard | cilium-fips-1.14 | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-clustermesh-apiserver | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-compat | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-container-init | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-container-init-compat | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-host-utils | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-hubble-relay | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-iptables | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-operator-aws | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-operator-azure | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-operator-generic | 1.14.19-r24 |
| Chainguard | cilium-fips-1.15 | 0 |
| Chainguard | cilium-fips-1.15-clustermesh-apiserver | 0 |
| Chainguard | cilium-fips-1.15-container-init | 0 |
| Chainguard | cilium-fips-1.15-container-init-compat | 0 |
| Chainguard | cilium-fips-1.15-host-utils | 0 |
| Chainguard | cilium-fips-1.15-hubble-relay | 0 |
| Chainguard | cilium-fips-1.15-operator-aws | 0 |
| Chainguard | cilium-fips-1.15-operator-azure | 0 |
| Chainguard | cilium-fips-1.15-operator-generic | 0 |
| Chainguard | hubble-ui | 0.13.3-r1 |
| Chainguard | hubble-ui | 0.13.0-r3 |
| Chainguard | hubble-ui-backend | 0.13.0-r3 |
| Chainguard | hubble-ui-backend | 0.13.3-r3 |
| Chainguard | hubble-ui-backend-fips | 0.13.0-r3 |
| Wolfi | cilium-1.14 | 1.14.19-r34 |
| Wolfi | cilium-1.14-container-init | 1.14.19-r34 |
| Wolfi | cilium-1.14-container-init-compat | 1.14.19-r34 |
| Wolfi | cilium-1.14-hubble-relay | 1.14.19-r34 |
| Wolfi | cilium-1.14-iptables | 1.14.19-r34 |
| Wolfi | cilium-1.14-operator-generic | 1.14.19-r34 |
| Wolfi | cilium-1.15 | 0 |
| Wolfi | cilium-1.15-container-init | 0 |
| Wolfi | cilium-1.15-container-init-compat | 0 |
| Wolfi | cilium-1.15-hubble-relay | 0 |
| Wolfi | cilium-1.15-iptables | 0 |
| Wolfi | cilium-1.15-operator-aws | 0 |
| Wolfi | cilium-1.15-operator-generic | 0 |
| Wolfi | hubble-ui | 0.13.0-r3 |
| Wolfi | hubble-ui | 0.13.3-r1 |
| Wolfi | hubble-ui-backend | 0.13.0-r3 |
| Wolfi | hubble-ui-backend | 0.13.3-r3 |