Sensitive Data Exposure in Cilium Due to `cilium-bugtool` Output
CVE-2024-37307
What is CVE-2024-37307?
Cilium, a networking and security solution, contains a vulnerability that results in the exposure of sensitive data when using the cilium-bugtool with the --envoy-dump flag enabled. This affects deployments utilizing the Envoy proxy where features such as TLS inspection, Ingress with TLS termination, and Kafka network policies with API key filtering are in use. The vulnerable versions include those prior to v1.15.6, v1.14.12, and v1.13.17. The sensitive data can encompass CA certificates, certificate chains, and private keys utilized by the Cilium Network Policies, as well as API keys linked to Kafka network policies. This is especially concerning as cilium-bugtool is typically invoked manually for debugging and does not operate as part of regular cluster functionality. This issue necessitates swift patching to mitigate potential risks to confidentiality.
Affected Version(s)
cilium >= 1.13.0, < 1.13.17 < 1.13.0, 1.13.17
cilium >= 1.14.0, < 1.14.12 < 1.14.0, 1.14.12
cilium >= 1.15.0, < 1.15.6 < 1.15.0, 1.15.6