CVE-2024-25630

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the default configuration) and Wireguard transparent encryption, traffic to/from the Ingress and health endpoints is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and has been patched in Cilium v1.14.7. There is no workaround to this issue.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.0

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://docs.cilium.io/en/stable/security/network/encryption-wireguard/#encryption-wg	Product
https://github.com/cilium/cilium/releases/tag/v1.14.7	Release Notes
https://github.com/cilium/cilium/security/advisories/GHSA-7496-fgv9-xw82	Vendor Advisory
https://docs.cilium.io/en/stable/security/network/encryption-wireguard/#encryption-wg	Product
https://github.com/cilium/cilium/releases/tag/v1.14.7	Release Notes
https://github.com/cilium/cilium/security/advisories/GHSA-7496-fgv9-xw82	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*

History

18 Dec 2024, 17:17

Type	Values Removed	Values Added
First Time		Cilium cilium Cilium
CWE		CWE-319
CPE		cpe:2.3:a:cilium:cilium::::::::
References	~~() https://docs.cilium.io/en/stable/security/network/encryption-wireguard/#encryption-wg -~~	() https://docs.cilium.io/en/stable/security/network/encryption-wireguard/#encryption-wg - Product
References	~~() https://github.com/cilium/cilium/releases/tag/v1.14.7 -~~	() https://github.com/cilium/cilium/releases/tag/v1.14.7 - Release Notes
References	~~() https://github.com/cilium/cilium/security/advisories/GHSA-7496-fgv9-xw82 -~~	() https://github.com/cilium/cilium/security/advisories/GHSA-7496-fgv9-xw82 - Vendor Advisory

Information

Published : 2024-02-20 18:15

Updated : 2024-12-18 17:17

NVD link : CVE-2024-25630

Mitre link : CVE-2024-25630

CVE.ORG link : CVE-2024-25630

JSON object : View

Products Affected

cilium

cilium

CWE

CWE-311

Missing Encryption of Sensitive Data

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2024-25630", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "published": "2024-02-20T18:15:52.930", "references": [{"url": "https://docs.cilium.io/en/stable/security/network/encryption-wireguard/#encryption-wg", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cilium/cilium/releases/tag/v1.14.7", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cilium/cilium/security/advisories/GHSA-7496-fgv9-xw82", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://docs.cilium.io/en/stable/security/network/encryption-wireguard/#encryption-wg", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/cilium/cilium/releases/tag/v1.14.7", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/cilium/cilium/security/advisories/GHSA-7496-fgv9-xw82", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-311"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the default configuration) and Wireguard transparent encryption, traffic to/from the Ingress and health endpoints is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and has been patched in Cilium v1.14.7. There is no workaround to this issue."}, {"lang": "es", "value": "Cilium es una soluci\u00f3n de redes, observabilidad y seguridad con un plano de datos basado en eBPF. Para los usuarios de Cilium que utilizan CRD para almacenar el estado de Cilium (la configuraci\u00f3n predeterminada) y el cifrado transparente Wireguard, el tr\u00e1fico hacia/desde los endpoints de Ingress y de salud no est\u00e1 cifrado. Este problema afecta a Cilium v1.14 anterior a v1.14.7 y se ha solucionado en Cilium v1.14.7. No existe ning\u00fan workaround para este problema."}], "lastModified": "2024-12-18T17:17:18.427", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C317482C-39AE-48CE-8BE0-22940C109354", "versionEndExcluding": "1.14.7", "versionStartIncluding": "1.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}