CVE-2024-37307: Cilium Sensitive Data Exposure
Summary
CVE-2024-37307: Cilium leaks sensitive information in cilium-bugtool. Affects cilium versions >= 1.15.4, < 1.15.6. Fixed in 1.15.6. How to fix ↓
Also tracked for
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- cilium-proxy · Bitnami
- hubble-relay · Bitnami
- github.com/cilium/cilium · Go
- hubble · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2024-37307 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides features such as TLS inspection, Ingress with TLS termination, Gateway API with TLS termination, and Kafka network policies with API key filtering. These features are affected by a vulnerability that allows sensitive data exposure. Cilium HTTP Network Policies, Ingress/Gateway API, and Kafka-related network policies can leak the CA certificate, certificate chain, private key, and API keys. The vulnerability exists in Cilium versions 1.13.0 to 1.13.7, 1.14.0 to 1.14.12, and 1.15.0 to 1.15.6.
Vulnerability Detail
The vulnerability arises when running the cilium-bugtool with the --envoy-dump flag against Cilium deployments with the Envoy proxy enabled. This tool, used for debugging purposes, can inadvertently include sensitive data in its output. The exposed data includes the CA certificate, certificate chain, and private key used by Cilium HTTP Network Policies, as well as the API keys used in Ingress/Gateway API and Kafka-related network policies. This can lead to unauthorized access and potential misuse of the exposed data. The issue has been patched in Cilium versions 1.13.17, 1.14.12, and 1.15.6.
How To Fix
Minimum fixed version
1.15.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the patched versions of Cilium to mitigate the risk of sensitive data exposure.
Conclusion
The vulnerability in Cilium versions 1.13.0 to 1.13.7, 1.14.0 to 1.14.12, and 1.15.0 to 1.15.6 allows sensitive data exposure when using the cilium-bugtool with the --envoy-dump flag. This can lead to unauthorized access and misuse of the exposed data. To mitigate the risk, it is crucial to upgrade to the patched versions of Cilium: 1.13.17, 1.14.12, or 1.15.6. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for cilium →
FAQ
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides advanced features for network policy enforcement, load balancing, and service discovery in Kubernetes environments.
Cilium versions 1.13.0 to 1.13.7, 1.14.0 to 1.14.12, and 1.15.0 to 1.15.6 are affected by this vulnerability.
The sensitive data that can be exposed includes the CA certificate, certificate chain, private key used by Cilium HTTP Network Policies, and API keys used in Ingress/Gateway API and Kafka-related network policies.
To mitigate the risk, it is recommended to upgrade to the patched versions of Cilium: 1.13.17, 1.14.12, or 1.15.6. These versions address the vulnerability and prevent the exposure of sensitive data.
No, there is no known workaround for this vulnerability. Upgrading to the patched versions of Cilium is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for cilium.
