| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/cilium/cilium | ≥ 1.13.0, < 1.15.16≥ 1.16.0, < 1.16.9≥ 1.17.0, < 1.17.3 | 1.15.161.16.91.17.3 |
| cilium | ≥ 1.13.0, < 1.15.16≥ 1.16.0, < 1.16.9≥ 1.17.0, < 1.17.3 | 1.15.161.16.91.17.3 |
When using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium.
This issue has been patched in https://github.com/cilium/cilium/pull/38592.
This issue affects:
This issue is fixed in:
There is no workaround to this issue.
The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @gandro and @pippolo84 for reporting this issue and to @julianwiedmann for the patch.
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free