Cilium Security Vulnerabilities

Cilium is an open source software. It is used to provide and transparently protect network connectivity and load balancing between application workloads such as application containers or processes. Cilium suffers from a security vulnerability that stems from the fact that HTTP policies are not...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: kargo, sops, timestamp-authority, vexctl, cosign, flux-kustomize-controller, step-ca, oauth2-proxy, zot, ko, kots, wolfictl, falcoctl, aactl, gitsign, dex, slsa-verifier, guac, frp, weaviate, flux-source-controller, tkn, caddy, temporal-ui-server, goreleaser,...

GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: nerdctl, gomplate-fips, argo-workflows, zarf, external-secrets-fips, slsa-verifier, gitsign, vault-csi-provider, ko, timestamp-authority, skaffold, vexctl, kubernetes-dashboard-fips, frp, sigstore-scaffolding, flux-source-controller, grpc-health-probe, cloudflared,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: logstash-exporter-fips, nerdctl, ferretdb, crossplane-provider-aws-sns, prometheus-elasticsearch-exporter, prometheus-beat-exporter, vertical-pod-autoscaler, prometheus-blackbox-exporter, zarf, vault-csi-provider, prometheus-alertmanager, timestamp-authority,...

GHSA-JW44-4F3J-Q396 vulnerabilities

Vulnerabilities for packages: cilium-cli, k9s...

GHSA-JW44-4F3J-Q396 vulnerabilities

Vulnerabilities for packages: k9s, cilium-cli...

CVE-2019-25210 vulnerabilities

Vulnerabilities for packages: cilium-cli, k9s...

CVE-2019-25210 vulnerabilities

Vulnerabilities for packages: k9s, cilium-cli...

GHSA-R53H-JV2G-VPX6 vulnerabilities

Vulnerabilities for packages: eksctl, chartmuseum, k9s, zot, flux-source-controller, flux-helm-controller, kots, k8sgpt, helm-push, up, cilium-cli, kubevela, kubescape, helm-operator, zarf, trivy...

Missing Encryption

github.com/cilium/cilium is vulnerable to Missing Encryption. The vulnerability is due to a lack of encryption to/from the Ingress and health endpoints when CRDs are used to store the Cilium state and Wireguard transparent encryption is enabled, which allows an attacker to eavesdrop on the...

Missing Encryption

github.com/cilium/cilium is vulnerable to Missing Encryption between pods. The vulnerability is caused when external key-value store kvstore and Wireguard transparent encryption are enabled. If an attacker has access to the underlying cluster they can intercept sensitive traffic between pods,...

Unencrypted traffic between pods when using Wireguard and an external kvstore

Impact For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. Patches This issue affects Cilium v1.14 before v1.14.7. This issue has been patched in Cilium v1.14.7. Workarounds There is no workarou...

GHSA-X989-52FC-4VR4 Unencrypted traffic between pods when using Wireguard and an external kvstore

Impact For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. Patches This issue affects Cilium v1.14 before v1.14.7. This issue has been patched in Cilium v1.14.7. Workarounds There is no workarou...

Unencrypted ingress/health traffic when using Wireguard transparent encryption

Impact For Cilium users who are using CRDs to store Cilium state the default configuration and Wireguard transparent encryption, responses from pods to the Ingress and health endpoints are not encrypted. Traffic from the Ingress and health endpoints to pods is not affected by this issue. The heal...

GHSA-7496-FGV9-XW82 Unencrypted ingress/health traffic when using Wireguard transparent encryption

Impact For Cilium users who are using CRDs to store Cilium state the default configuration and Wireguard transparent encryption, responses from pods to the Ingress and health endpoints are not encrypted. Traffic from the Ingress and health endpoints to pods is not affected by this issue. The heal...

CVE-2024-25631

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and...

CVE-2024-25630

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state the default configuration and Wireguard transparent encryption, traffic to/from the Ingress and health endpoints is not encrypted. This issue affect...

Code injection

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and...

Default configuration

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state the default configuration and Wireguard transparent encryption, traffic to/from the Ingress and health endpoints is not encrypted. This issue affect...

CVE-2024-25631

CVE-2024-25631 affects Cilium v1.14 prior to 1.14.7 when an external kvstore and WireGuard transparent encryption are enabled. The issue causes traffic between pods in the affected cluster to be unencrypted. Red Hat’s advisory confirms the problem affects Cilium v1.14 up to but not including v1.1...