CVE-2024-28249: Cilium IPsec-Eligible Traffic Unencrypted Vulnerability in Hubble
Summary
CVE-2024-28249: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Affects hubble across 3 version ranges.
< 1.13.13
>= 1.14.0, < 1.14.8
>= 1.15.0, < 1.15.2
Fixed in 1.13.13, 1.14.8 or 1.15.2, depending on the release line you run. How to fix ↓
Also tracked for
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- cilium-proxy · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
- github.com/cilium/cilium · Go
The same CVE-2024-28249 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides features such as load balancing, network policy enforcement, and service discovery for containerized applications. Hubble is a component of Cilium that offers network visibility and troubleshooting capabilities. It collects and exports flow-level telemetry data for analysis. This vulnerability affects Cilium clusters with IPsec enabled and traffic matching Layer 7 policies.
Vulnerability Detail
In Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node's Envoy proxy and pods on other nodes, as well as between a node's DNS proxy and pods on other nodes, is sent unencrypted. This means that sensitive data transmitted over these connections can be intercepted and read by attackers. The issue has been addressed in Cilium versions 1.13.13, 1.14.8, and 1.15.2.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.13.131.13.13 -
>= 1.14.0, < 1.14.81.14.8 -
>= 1.15.0, < 1.15.21.15.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The Cilium IPsec-Eligible Traffic Unencrypted Vulnerability in Hubble can allow attackers to intercept and read sensitive data transmitted between Envoy proxies and pods, as well as DNS proxies and pods. It is crucial to upgrade to Cilium versions 1.13.13, 1.14.8, or 1.15.2 to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hubble →
FAQ
Cilium is a networking, observability, and security solution for containerized applications. It provides features such as load balancing, network policy enforcement, and service discovery.
Hubble is a component of Cilium that offers network visibility and troubleshooting capabilities. It collects and exports flow-level telemetry data for analysis.
IPsec (Internet Protocol Security) is a protocol suite used to secure Internet Protocol (IP) communications by authenticating and encrypting each IP packet in a communication session.
Layer 7 policy matching refers to the ability to define network policies based on application-layer attributes, such as HTTP headers or payload contents.
You can check the version of Cilium installed by running the 'cilium status' command in your cluster. It will display the Cilium version along with other relevant information.
References
Related vulnerabilities
Recent vulnerabilities recorded for hubble.
