CVE-2024-28860
published 2024-03-27CVE-2024-28860: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to…
PriorityP430medium6.8CVSS 3.1
AVAACHPRNUINSUCHIHAN
EPSS
0.17%
7.0th percentile
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to chosen plaintext, key recovery, replay attacks by a man-in-the-middle attacker. These attacks are possible due to an ESP sequence number collision when multiple nodes are configured with the same key. Fixed versions of Cilium use unique keys for each IPsec tunnel established between nodes, resolving all of the above attacks. This vulnerability is fixed in 1.13.13, 1.14.9, and 1.15.3.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cilium | cilium | — | — |
| cilium | cilium | — | — |
| cilium | cilium | — | — |
| cilium | cilium | >= 1.14.0 < 1.14.9 | 1.14.9 |
| cilium | cilium | >= 1.15.0 < 1.15.3 | 1.15.3 |
| cilium | cilium | >= 1.4.0 < 1.13.14 | 1.13.14 |
| github.com | cilium_cilium | >= 0 < 1.13.14 | 1.13.14 |
| github.com | cilium_cilium | >= 1.14.0 < 1.14.9 | 1.14.9 |
| github.com | cilium_cilium | >= 1.15.0 < 1.15.3 | 1.15.3 |
| github.com | cilium_cilium | >= 1.4.0 < 1.13.14 | 1.13.14 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Insecure IPsec transparent encryption in github.com/cilium/cilium
osv·2024-04-16
CVE-2024-28860 Insecure IPsec transparent encryption in github.com/cilium/cilium
Insecure IPsec transparent encryption in github.com/cilium/cilium
Insecure IPsec transparent encryption in github.com/cilium/cilium
GHSA
Cilium has insecure IPsec transport encryption
ghsa·2024-03-28
CVE-2024-28860 [HIGH] CWE-326 Cilium has insecure IPsec transport encryption
Cilium has insecure IPsec transport encryption
### Impact
Users of [IPsec transparent encryption](https://docs.cilium.io/en/stable/security/network/encryption-ipsec/) in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective.
In particular, Cilium is vulnerable to the following attacks by a man-in-the-middle attacker:
- Chosen plaintext attacks
- Key recovery attacks
- Replay attacks
These attacks are possible due to an ESP sequence number collision when multiple nodes are configured with the same key. Fixed versions of Cilium use unique keys for each IPsec tunnel established between nodes, resolving all of the above attacks.
**Important:** After upgrading, users must perform a key rotation using the instructions [here](https://docs.ciliu
OSV
Cilium has insecure IPsec transport encryption
osv·2024-03-28
CVE-2024-28860 [HIGH] Cilium has insecure IPsec transport encryption
Cilium has insecure IPsec transport encryption
### Impact
Users of [IPsec transparent encryption](https://docs.cilium.io/en/stable/security/network/encryption-ipsec/) in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective.
In particular, Cilium is vulnerable to the following attacks by a man-in-the-middle attacker:
- Chosen plaintext attacks
- Key recovery attacks
- Replay attacks
These attacks are possible due to an ESP sequence number collision when multiple nodes are configured with the same key. Fixed versions of Cilium use unique keys for each IPsec tunnel established between nodes, resolving all of the above attacks.
**Important:** After upgrading, users must perform a key rotation using the instructions [here](https://docs.ciliu
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://docs.cilium.io/en/stable/security/network/encryption-ipsechttps://github.com/cilium/cilium/commit/311fbce5280491cddceab178d83b06fa23688c72https://github.com/cilium/cilium/commit/a1742b478306fa256cd27df1039dfae0537b4149https://github.com/cilium/cilium/commit/a652c123331852cca90c74202f993d4170fd37fahttps://github.com/cilium/cilium/security/advisories/GHSA-pwqm-x5x6-5586https://docs.cilium.io/en/stable/security/network/encryption-ipsechttps://github.com/cilium/cilium/commit/311fbce5280491cddceab178d83b06fa23688c72https://github.com/cilium/cilium/commit/a1742b478306fa256cd27df1039dfae0537b4149https://github.com/cilium/cilium/commit/a652c123331852cca90c74202f993d4170fd37fahttps://github.com/cilium/cilium/security/advisories/GHSA-pwqm-x5x6-5586
2024-03-27
Published