CVE-2024-28860
Insecure IPsec transport encryption in Cilium
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to chosen plaintext, key recovery, replay attacks by a man-in-the-middle attacker. These attacks are possible due to an ESP sequence number collision when multiple nodes are configured with the same key. Fixed versions of Cilium use unique keys for each IPsec tunnel established between nodes, resolving all of the above attacks. This vulnerability is fixed in 1.13.13, 1.14.9, and 1.15.3.
Cilium es una solución de redes, observabilidad y seguridad con un plano de datos basado en eBPF. Los usuarios de cifrado transparente IPsec en Cilium pueden ser vulnerables a ataques criptográficos que hagan que el cifrado transparente sea ineficaz. En particular, Cilium es vulnerable a texto plano elegido, recuperación de claves y ataques de repetición por parte de un atacante intermediario. Estos ataques son posibles debido a una colisión del número de secuencia ESP cuando se configuran varios nodos con la misma clave. Las versiones fijas de Cilium utilizan claves únicas para cada túnel IPsec establecido entre nodos, resolviendo todos los ataques anteriores. Esta vulnerabilidad se solucionó en 1.13.13, 1.14.9 y 1.15.3.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-03-11 CVE Reserved
- 2024-03-27 CVE Published
- 2024-03-28 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-326: Inadequate Encryption Strength
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://docs.cilium.io/en/stable/security/network/encryption-ipsec | X_refsource_misc | |
| https://github.com/cilium/cilium/commit/311fbce5280491cddceab178d83b06fa23688c72 | X_refsource_misc | |
| https://github.com/cilium/cilium/commit/a1742b478306fa256cd27df1039dfae0537b4149 | X_refsource_misc | |
| https://github.com/cilium/cilium/commit/a652c123331852cca90c74202f993d4170fd37fa | X_refsource_misc | |
| https://github.com/cilium/cilium/security/advisories/GHSA-pwqm-x5x6-5586 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Cilium Search vendor "Cilium" | Cilium Search vendor "Cilium" for product "Cilium" | >= 1.4.0 <= 1.13.14 Search vendor "Cilium" for product "Cilium" and version " >= 1.4.0 <= 1.13.14" | en |
Affected
| ||||||
| Cilium Search vendor "Cilium" | Cilium Search vendor "Cilium" for product "Cilium" | >= 1.14.0 < 1.14.9 Search vendor "Cilium" for product "Cilium" and version " >= 1.14.0 < 1.14.9" | en |
Affected
| ||||||
| Cilium Search vendor "Cilium" | Cilium Search vendor "Cilium" for product "Cilium" | >= 1.15.0 < 1.15.3 Search vendor "Cilium" for product "Cilium" and version " >= 1.15.0 < 1.15.3" | en |
Affected
| ||||||