CVE-2024-37307: Vulnerability in Cilium
Summary
CVE-2024-37307: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Affects hubble across 3 version ranges.
>= 1.13.0, < 1.13.17
>= 1.14.0, < 1.14.12
>= 1.15.0, < 1.15.6
Fixed in 1.13.17, 1.14.12 or 1.15.6, depending on the release line you run. How to fix ↓
Also tracked for
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- cilium-proxy · Bitnami
- hubble-relay · Bitnami
- github.com/cilium/cilium · Go
- cilium · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2024-37307 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides features such as TLS inspection, Ingress with TLS termination, Gateway API with TLS termination, and Kafka network policies with API key filtering. These features are affected by a vulnerability in Cilium versions 1.13.0 to 1.13.7, 1.14.0 to 1.14.12, and 1.15.0 to 1.15.6. The vulnerability allows sensitive data, including CA certificates, certificate chains, private keys, and API keys, to be exposed when using the cilium-bugtool with the --envoy-dump flag enabled.
Vulnerability Detail
The vulnerability in Cilium arises from the output of cilium-bugtool containing sensitive data when run against Cilium deployments with the Envoy proxy enabled. This can lead to the exposure of CA certificates, certificate chains, private keys, and API keys used by Cilium HTTP Network Policies, Ingress/Gateway API, and Kafka-related network policies. It is important to note that cilium-bugtool is a debugging tool that is manually invoked and does not run during normal operation of a Cilium cluster.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.13.0, < 1.13.171.13.17 -
>= 1.14.0, < 1.14.121.14.12 -
>= 1.15.0, < 1.15.61.15.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, the vulnerability in Cilium versions 1.13.0 to 1.13.7, 1.14.0 to 1.14.12, and 1.15.0 to 1.15.6 can expose sensitive data when using cilium-bugtool with the --envoy-dump flag enabled. Upgrading to the patched versions of Cilium (v1.13.17, v1.14.12, or v1.15.6) is necessary to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hubble →
FAQ
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides advanced features for network policies, TLS inspection, and API key filtering.
Cilium versions 1.13.0 to 1.13.7, 1.14.0 to 1.14.12, and 1.15.0 to 1.15.6 are affected by this vulnerability.
cilium-bugtool is a debugging tool in Cilium that is manually invoked for troubleshooting purposes. It is not part of the normal operation of a Cilium cluster.
This vulnerability can expose CA certificates, certificate chains, private keys, and API keys used by Cilium HTTP Network Policies, Ingress/Gateway API, and Kafka-related network policies.
To fix this vulnerability, it is recommended to upgrade to the patched versions of Cilium: v1.13.17, v1.14.12, or v1.15.6.
References
Related vulnerabilities
Recent vulnerabilities recorded for hubble.
