CVE-2024-28250
Description
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.8 and 1.15.2, In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies Wireguard-eligible traffic that is sent between a node's Envoy proxy and pods on other nodes is sent unencrypted and Wireguard-eligible traffic that is sent between a node's DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.14.8 and 1.15.2 in in native routing mode (`routingMode=native`) and in Cilium 1.14.4 in tunneling mode (`routingMode=tunnel`). Not that in tunneling mode, `encryption.wireguard.encapsulate` must be set to `true`. There is no known workaround for this issue.
How to fix
- cilium cilium1.14.8, 1.15.2 or later
- github.com/cilium/cilium1.14.8, 1.15.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cilium cilium | 1.14.0 ≤ v < 1.14.8, 1.15.0 ≤ v < 1.15.2 | 1.14.8, 1.15.2 |
| github.com/cilium/ciliumGo | 1.14.0 ≤ v < 1.14.8, 1.15.0 ≤ v < 1.15.2 | 1.14.8, 1.15.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.