GHSA-J89H-QRVR-XC36 Unencrypted traffic between nodes when using IPsec and L7 policies

Impact In Cilium clusters with IPsec enabled and traffic matching Layer 7 policies: - Traffic that should be IPsec-encrypted between a node's Envoy proxy and pods on other nodes is sent unencrypted - Traffic that should be IPsec-encrypted between a node's DNS proxy and pods on other nodes is sent...

Intermittent HTTP policy bypass

Impact Cilium's HTTP policies are not consistently applied to all traffic in the scope of the policies, leading to HTTP traffic being incorrectly and intermittently forwarded when it should be dropped. Patches This issue affects: Cilium v1.13 between v1.13.9 and v1.13.12 inclusive Cilium v1.14...

GHSA-68MJ-9PJQ-MC85 Intermittent HTTP policy bypass

Impact Cilium's HTTP policies are not consistently applied to all traffic in the scope of the policies, leading to HTTP traffic being incorrectly and intermittently forwarded when it should be dropped. Patches This issue affects: Cilium v1.13 between v1.13.9 and v1.13.12 inclusive Cilium v1.14...

GHSA-68MJ-9PJQ-MC85 vulnerabilities

Vulnerabilities for packages: hubble-ui-backend-fips, hubble-ui...

PT-2024-22366 · Cilium · Cilium

Name of the Vulnerable Software and Affected Versions: Cilium versions 1.14.0 through 1.14.7 Cilium versions 1.15.0 through 1.15.1 Cilium version 1.14.4 with encryption.wireguard.encapsulate set to false in tunneling mode Description: In Cilium clusters with WireGuard enabled and traffic matching...

Cilium Security Vulnerabilities

Cilium is an open source software. It is used to provide and transparently protect network connectivity and load balancing between application workloads such as application containers or processes. Cilium suffers from a security vulnerability that stems from the possibility of unencrypted traffic...

PT-2024-22363 · Cilium · Cilium

Name of the Vulnerable Software and Affected Versions: Cilium versions 1.13.9 through 1.13.12 Cilium versions 1.14.0 through 1.14.7 Cilium versions 1.15.0 through 1.15.1 Description: Cilium's HTTP policies are not consistently applied to all traffic in the scope of the policies, leading to HTTP...

Cilium Security Vulnerabilities

Cilium is an open source software. It is used to provide and transparently protect network connectivity and load balancing between application workloads such as application containers or processes. Cilium has a security vulnerability that stems from the possibility of unencrypted traffic between...

Cilium Security Vulnerabilities

Cilium is an open source software. It is used to provide and transparently protect network connectivity and load balancing between application workloads such as application containers or processes. Cilium suffers from a security vulnerability that stems from the fact that HTTP policies are not...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: skopeo, kubernetes-dashboard, grpc-health-probe, guac, zot, sigstore-scaffolding, zarf, wolfictl, oauth2-proxy, tekton-chains, spire-server, slsa-verifier, timestamp-authority, kube-rbac-proxy, k3s, sops, nerdctl, vexctl, kots, goreleaser, skaffold,...

GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: skaffold, goreleaser, neuvector-fips, nerdctl, falcoctl, dgraph, falcoctl-fips, aactl, zarf, caddy, cloudflared, ko, gomplate-fips, step, spire-server, k3s, melange, sigstore-scaffolding-fips, cosign-fips, minio, fulcio-fips, spire-server-fips, rook,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: skaffold, nerdctl, zarf, caddy, helm, cass-operator-fips, kubernetes-csi-driver-hostpath, cloudflared, smarter-device-manager, secrets-store-csi-driver-provider-aws, gcsfuse, temporal-server-fips, spark-operator, nri-discovery-kubernetes, metallb,...

GHSA-JW44-4F3J-Q396 vulnerabilities

Vulnerabilities for packages: cilium-cli, k9s...

GHSA-JW44-4F3J-Q396 vulnerabilities

Vulnerabilities for packages: k9s, cilium-cli...

CVE-2019-25210 vulnerabilities

Vulnerabilities for packages: k9s, cilium-cli...

CVE-2019-25210 vulnerabilities

Vulnerabilities for packages: cilium-cli, k9s...

GHSA-R53H-JV2G-VPX6 vulnerabilities

Vulnerabilities for packages: k9s, zarf, helm-push, k8sgpt, zot, kubescape, flux-helm-controller, trivy, helm-operator, cilium-cli, kubevela, chartmuseum, kots, up, flux-source-controller, eksctl...

Missing Encryption

github.com/cilium/cilium is vulnerable to Missing Encryption. The vulnerability is due to a lack of encryption to/from the Ingress and health endpoints when CRDs are used to store the Cilium state and Wireguard transparent encryption is enabled, which allows an attacker to eavesdrop on the...

Missing Encryption

github.com/cilium/cilium is vulnerable to Missing Encryption between pods. The vulnerability is caused when external key-value store kvstore and Wireguard transparent encryption are enabled. If an attacker has access to the underlying cluster they can intercept sensitive traffic between pods,...

Unencrypted traffic between pods when using Wireguard and an external kvstore

Impact For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. Patches This issue affects Cilium v1.14 before v1.14.7. This issue has been patched in Cilium v1.14.7. Workarounds There is no workarou...