CVE-2024-28249

MEDIUM EPSS 18.6%
Published Mar 18, 20242y ago · Modified Jun 17, 20261w ago
6.1 CVSS 3.1
Medium
Find Similar
Published Mar 18, 2024 2y ago
Last Modified Jun 17, 2026 1w ago

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node's Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node's DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue.

CVSS Details

Base Score
6.1
Exploitability
1.6
Impact
4.0
Vector string
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack Vector Adjacent
Attack Complexity High
Privileges Required None
User Interaction None
Scope Changed
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
18.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 2

CWE-311
CWE-319

Affected Products 3

VendorProductVersionRange
ciliumcilium* <1.13.13
ciliumcilium*≥1.14.0  –  <1.14.8
ciliumcilium*≥1.15.0  –  <1.15.2

References 4

  • github.com https://github.com/cilium/cilium/releases/tag/v1.13.13
    Release Notes
  • github.com https://github.com/cilium/cilium/releases/tag/v1.14.8
    Release Notes
  • github.com https://github.com/cilium/cilium/releases/tag/v1.15.2
    Release Notes
  • github.com https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.