CVE-2024-37307: Vulnerability in Bitnami Cilium Operator
Summary
CVE-2024-37307: Cilium leaks sensitive information in cilium-bugtool. Affects cilium-operator versions >= 1.15.4, < 1.15.6. Fixed in 1.15.6. How to fix ↓
Also tracked for
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- cilium-proxy · Bitnami
- hubble-relay · Bitnami
- github.com/cilium/cilium · Go
- hubble · Bitnami
- cilium · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2024-37307 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bitnami Cilium Operator is a networking, observability, and security solution that utilizes an eBPF-based dataplane. It is designed to enhance network connectivity, provide monitoring capabilities, and ensure secure communication within a Cilium cluster. However, versions 1.13.0 to 1.13.7, 1.14.0 to 1.14.12, and 1.15.0 to 1.15.6 of the Cilium Operator are susceptible to a security flaw.
Vulnerability Detail
The vulnerability arises when running the cilium-bugtool with the --envoy-dump flag enabled against Cilium deployments that have the Envoy proxy enabled. This can lead to the exposure of sensitive data, including the CA certificate, certificate chain, and private key used by Cilium HTTP Network Policies. Additionally, it affects users of TLS inspection, Ingress with TLS termination, Gateway API with TLS termination, and Kafka network policies with API key filtering features. It is important to note that cilium-bugtool is a debugging tool typically used manually and not during normal cluster operation. The issue has been addressed in Cilium versions 1.13.17, 1.14.12, and 1.15.6.
How To Fix
Minimum fixed version
1.15.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. However, users can mitigate the risk by avoiding the use of cilium-bugtool with the --envoy-dump flag against Cilium deployments with the Envoy proxy enabled.
Conclusion
In conclusion, the Bitnami Cilium Operator is vulnerable to a security flaw that can expose sensitive data when using the cilium-bugtool with the --envoy-dump flag against Cilium deployments with the Envoy proxy enabled. It is crucial to upgrade to the patched versions (v1.13.17, v1.14.12, or v1.15.6) to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cilium-operator →
FAQ
Cilium Operator is a networking, observability, and security solution that utilizes an eBPF-based dataplane to enhance network connectivity, provide monitoring capabilities, and ensure secure communication within a Cilium cluster.
Versions 1.13.0 to 1.13.7, 1.14.0 to 1.14.12, and 1.15.0 to 1.15.6 of the Cilium Operator are affected by this vulnerability.
The sensitive data that can be exposed includes the CA certificate, certificate chain, and private key used by Cilium HTTP Network Policies, as well as API keys used in Kafka-related network policies.
While there is no specific workaround available, users can mitigate the risk by refraining from using cilium-bugtool with the --envoy-dump flag against Cilium deployments with the Envoy proxy enabled.
To fix this vulnerability, it is recommended to upgrade to the latest patched versions of Cilium (v1.13.17, v1.14.12, or v1.15.6).
References
Related vulnerabilities
Recent vulnerabilities recorded for cilium-operator.
