Sensitive Data Exposure in Cilium
Summary
CVE-2024-37307: Cilium leaks sensitive information in cilium-bugtool. Affects hubble-relay versions >= 1.13.0, < 1.15.6. Fixed in 1.15.6. How to fix ↓
Also tracked for
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- cilium-proxy · Bitnami
- github.com/cilium/cilium · Go
- hubble · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2024-37307 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides features such as TLS inspection, Ingress with TLS termination, Gateway API with TLS termination, and Kafka network policies with API key filtering. These features enhance the security and performance of Cilium deployments. However, a vulnerability has been discovered in versions 1.13.0 to 1.13.7, 1.14.0 to 1.14.12, and 1.15.0 to 1.15.6 of Cilium. This vulnerability exposes sensitive data when using the cilium-bugtool tool with the --envoy-dump flag enabled against Cilium deployments with the Envoy proxy enabled.
Vulnerability Detail
The vulnerability in Cilium allows the cilium-bugtool tool to include sensitive data in its output. This data includes the CA certificate, certificate chain, and private key used by Cilium HTTP Network Policies. Additionally, when using Ingress/Gateway API and Kafka-related network policies, the API keys used are also exposed. This sensitive information can be accessed by an attacker who gains access to the output of cilium-bugtool. The tool is typically used for debugging purposes and is not meant to run during normal operation. The impact of this vulnerability is significant as it exposes critical security information, potentially leading to unauthorized access or interception of network traffic.
How To Fix
Minimum fixed version
1.15.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Cilium versions 1.13.0 to 1.13.7, 1.14.0 to 1.14.12, and 1.15.0 to 1.15.6 exposes sensitive data when using the cilium-bugtool tool with the --envoy-dump flag enabled. Upgrading to the patched versions of Cilium (v1.13.17, v1.14.12, or v1.15.6) is the recommended solution to mitigate this vulnerability.
See every vulnerability recorded for hubble-relay →
FAQ
The cilium-bugtool tool is a debugging tool used in Cilium deployments. It helps diagnose and troubleshoot issues by collecting relevant information about the deployment.
An attacker would need to gain access to the output of cilium-bugtool with the --envoy-dump flag enabled. This can be done by compromising the system where the tool is run or by intercepting the output of the tool.
No, only Cilium deployments with the Envoy proxy enabled and using TLS inspection, Ingress with TLS termination, Gateway API with TLS termination, or Kafka network policies with API key filtering are affected.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the patched versions of Cilium.
The exposure of sensitive data, such as CA certificates, certificate chains, private keys, and API keys, can lead to unauthorized access, interception of network traffic, and potential compromise of the Cilium deployment.
References
Related vulnerabilities
Recent vulnerabilities recorded for hubble-relay.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
