CVE-2024-52529
published 2024-11-25CVE-2024-52529: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that…
PriorityP429medium5.8CVSS 3.1
AVNACLPRNUINSCCLINAN
EPSS
0.52%
43.2th percentile
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that selects a Layer 3 destination and a port range `AND` 2. A Layer 7 allow policy that selects a specific port within the first policy's range the Layer 7 enforcement would not occur for the traffic selected by the Layer 7 policy. This issue only affects users who use Cilium's port range functionality, which was introduced in Cilium v1.16. This issue is patched in PR #35150. This issue affects Cilium v1.16 between v1.16.0 and v1.16.3 inclusive. This issue is patched in Cilium v1.16.4. Users are advised to upgrade. Users with network policies that match the pattern described above can work around the issue by rewriting any policies that use port ranges to individually specify the ports permitted for traffic.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cilium | cilium | — | — |
| cilium | cilium | >= 1.16.0 < 1.16.4 | 1.16.4 |
| github.com | cilium_cilium | >= 1.16.0 < 1.16.4 | 1.16.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in github.com/cilium/cilium
osv·2024-11-27
CVE-2024-52529 Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in github.com/cilium/cilium
Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in github.com/cilium/cilium
Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in github.com/cilium/cilium
OSV
Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges
osv·2024-11-25
CVE-2024-52529 [MEDIUM] Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges
Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges
### Impact
For users with the following configuration:
* An allow policy that selects a [Layer 3 identity](https://docs.cilium.io/en/v1.14/security/policy/language/#layer-3-examples) and a [port range](https://docs.cilium.io/en/stable/security/policy/language/#example-port-ranges) **AND**
* A [Layer 7 allow policy](https://docs.cilium.io/en/latest/security/policy/language/#layer-7-examples) that selects a specific port within the first policy's range
then Layer 7 enforcement would not occur for the traffic selected by the Layer 7 policy.
This issue only affects users who use Cilium's port range functionality, which was introduced in Cilium v1.16.
For reference, an example of a pair of policies t
GHSA
Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges
ghsa·2024-11-25
CVE-2024-52529 [MEDIUM] CWE-755 Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges
Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges
### Impact
For users with the following configuration:
* An allow policy that selects a [Layer 3 identity](https://docs.cilium.io/en/v1.14/security/policy/language/#layer-3-examples) and a [port range](https://docs.cilium.io/en/stable/security/policy/language/#example-port-ranges) **AND**
* A [Layer 7 allow policy](https://docs.cilium.io/en/latest/security/policy/language/#layer-7-examples) that selects a specific port within the first policy's range
then Layer 7 enforcement would not occur for the traffic selected by the Layer 7 policy.
This issue only affects users who use Cilium's port range functionality, which was introduced in Cilium v1.16.
For reference, an example of a pair of policies t
No detection rules found.
No public exploits indexed.
2024-11-25
Published