Cilium Fixes Issue with HTTP Policies Not Consistently Applied
CVE-2024-28248

7.2HIGH

Key Information:

Vendor

Cilium

Status
Cilium
Vendor
CVE Published:
18 March 2024

What is CVE-2024-28248?

Cilium, a networking, observability, and security solution developed by Isovalent, encountered an issue where HTTP policies were not properly enforced across all traffic. This inconsistency resulted in certain HTTP traffic being incorrectly forwarded instead of being dropped, posing potential security risks. This vulnerability affects versions of Cilium before the updates introduced in 1.13.13, 1.14.8, and 1.15.2. No workarounds are available, making it essential for users to update to the patched versions to ensure robust security and compliance with HTTP policies.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

cilium >= 1.13.9, < 1.13.13 < 1.13.9, 1.13.13

cilium >= 1.14.0, < 1.14.8 < 1.14.0, 1.14.8

cilium >= 1.15.0, < 1.15.2 < 1.15.0, 1.15.2

References

https://github.com/cilium/cilium/security/advisories/GHSA...
x_refsource_CONFIRM
https://docs.cilium.io/en/stable/security/policy/language...
x_refsource_MISC
https://github.com/cilium/cilium/releases/tag/v1.13.13
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.