BIT-CILIUM-2024-47825 CIDR deny policies may not take effect when a more narrow CIDR allow is present

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than /32 may be ignored if there is a policy rule referencing a more narrow prefix CIDRSe...

BIT-CILIUM-OPERATOR-2024-47825 CIDR deny policies may not take effect when a more narrow CIDR allow is present

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than /32 may be ignored if there is a policy rule referencing a more narrow prefix CIDRSe...

CVE-2024-47825

CVE-2024-47825 affects Cilium's policy evaluation in versions prior to 1.14.16 and 1.15.10, where a rule denying a wide CIDR (> /32) could be ignored if a narrower rule references CIDRSet or toFQDN and uses enableDefaultDeny: false or toEntities: all. The issue is mitigated by upgrading to Cil...