Missing Encryption

2024-02-2106:47:17

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github

cilium

vulnerability

encryption

pods

key-value store

wireguard

transparent

attacker

sensitive information

CVSS3

6.1

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

6.3

Confidence

Low

EPSS

Percentile

15.5%

JSON

github.com/cilium/cilium is vulnerable to Missing Encryption between pods. The vulnerability is caused when external key-value store (kvstore) and Wireguard transparent encryption are enabled. If an attacker has access to the underlying cluster they can intercept sensitive traffic between pods, resulting in sensitive information disclosure.