CVE-2024-28249

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node's Envoy proxy and pods on other nodes is sent unencrypted and IPsec-eligible traffic between a node's DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.15.2, 1.14.8, and 1.13.13. There is no known workaround for this issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-311 CWE-319

Affected software

Vendor	Product	Versions
cilium	cilium	< 1.13.13; >= 1.14.0, < 1.14.8; >= 1.15.0, < 1.15.2

References

https://github.com/cilium/cilium/releases/tag/v1.13.13Release Notes
https://github.com/cilium/cilium/releases/tag/v1.14.8Release Notes
https://github.com/cilium/cilium/releases/tag/v1.15.2Release Notes
https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36Vendor Advisory
https://github.com/cilium/cilium/releases/tag/v1.13.13Release Notes
https://github.com/cilium/cilium/releases/tag/v1.14.8Release Notes
https://github.com/cilium/cilium/releases/tag/v1.15.2Release Notes
https://github.com/cilium/cilium/security/advisories/GHSA-j89h-qrvr-xc36Vendor Advisory

Timeline

Published: Mar 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-28258.8A vulnerability classified as critical has been found in lakernote EasyAdmin up to 20240315. This affects an unknown part of the file /urepo CVE-2024-282506.1Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions CVE-2024-282517.3Querybook is a Big Data Querying UI, combining collocated table metadata and a simple notebook interface. Querybook's datadocs functionality CVE-2024-282527.5CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. If you have a NetFraming based CoreWCF service CVE-2024-282538.8OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, CVE-2024-282548.8OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, CVE-2024-282559.8OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, CVE-2024-28268.8A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the fi CVE-2024-282659.1IBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php.CVE-2024-282697.2ReCrystallize Server 5.10.0.0 allows administrators to upload files to the server. The file upload is not restricted, leading to the ability CVE-2024-28278.8A vulnerability, which was classified as critical, has been found in lakernote EasyAdmin up to 20240315. This issue affects some unknown pro CVE-2024-282708.1An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/res