Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2024-28249: Cilium: IPsec Traffic Exposed in Certain Network Configurations
CVE-2024-28249 · published 2 years ago
Summary
Cilium's IPsec encryption is disabled for certain types of network traffic in clusters with IPsec enabled. This means that sensitive information may be sent unencrypted between nodes in your network. To fix this, update to Cilium version 1.15.2, 1.14.8, or 1.13.13 or later.
What to do
- Update github.com cilium to version 1.13.13.
- Update github.com cilium to version 1.14.8.
- Update github.com cilium to version 1.15.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | cilium |
< 1.13.13 >= 1.14.0, < 1.14.8 >= 1.15.0, < 1.15.2 Fix: upgrade to 1.13.13
|
| – | cilium | cilium |
< 1.13.13 >= 1.14.0, < 1.14.8 >= 1.15.0, < 1.15.2 cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:* |
Original advisory text
Cilium has possible unencrypted traffic between nodes when using IPsec and L7 policies
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node's Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node's DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-28249 Vendor Advisory
- https://github.com/advisories/GHSA-j89h-qrvr-xc36
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28249... Vendor Advisory
- https://github.com/cilium/cilium/releases/tag/v1.13.13 URL
- https://github.com/cilium/cilium/releases/tag/v1.14.8 URL
- https://github.com/cilium/cilium/releases/tag/v1.15.2 URL
- https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-311Missing Encryption of Sensitive Data
CWE-319Cleartext Transmission of Sensitive Information
Timeline
Published18 Mar 2024
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta