CVE-2024-25630

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-25630

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-25630.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-25630

Aliases

Downstream

CGA (40)

Published

2024-02-20T17:53:16Z

Modified

2026-10-21T02:51:12Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator

Summary

Cilium has unencrypted ingress/health traffic when using Wireguard transparent encryption

Details

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the default configuration) and Wireguard transparent encryption, traffic to/from the Ingress and health endpoints is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and has been patched in Cilium v1.14.7. There is no workaround to this issue.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-311"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25630.json"
}

References

Affected packages

Git / github.com/cilium/cilium

Affected ranges

Type

GIT

Repo

https://github.com/cilium/cilium

Events

Introduced

b5013e1562dbfe442dd2011a5af46de9095315ff

Fixed

91b461c78160ff5c96cad23a85e4287093753c22

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.14.0"
                },
                {
                    "fixed":  "1.14.7"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "original_tag":  "v1.14.7",
            "range":  [
                {
                    "fixed":  "91b461c78160ff5c96cad23a85e4287093753c22"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "cpe":  "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.14.0"
                },
                {
                    "fixed":  "1.14.7"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

1.*

1.14.0

1.14.1

1.14.2

1.14.3

1.14.4

1.14.5

1.14.6

v1.*

v1.14.0

v1.14.1

v1.14.2

v1.14.3

v1.14.4

v1.14.5

v1.14.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-25630.json"