CVE-2024-25630

low-risk
Published 2024-02-20

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the default configuration) and Wireguard transparent encryption, traffic to/from the Ingress and health endpoints is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and has been patched in Cilium v1.14.7. There is no workaround to this issue.

Do I need to act?

-
0.05% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10 Medium
ADJACENT_NETWORK / HIGH complexity

Affected Products (1)

Affected Vendors

Cilium

References (6)

Product https://docs.cilium.io/en/stable/security/network/encryption-wireguard/#encrypti...
Release Notes https://github.com/cilium/cilium/releases/tag/v1.14.7
Vendor Advisory https://github.com/cilium/cilium/security/advisories/GHSA-7496-fgv9-xw82
Product https://docs.cilium.io/en/stable/security/network/encryption-wireguard/#encrypti...
Release Notes https://github.com/cilium/cilium/releases/tag/v1.14.7
Vendor Advisory https://github.com/cilium/cilium/security/advisories/GHSA-7496-fgv9-xw82
21
/ 100
low-risk
Severity 16/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal