6.1 Medium
CVSS3
Attack Vector
ADJACENT
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
6.6 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.5%
Cilium is vulnerable to Missing Encryption Of Sensitive Data. The vulnerability is due to WireGuard eligible traffic sent between a node’s Envoy/DNS proxy and pods on other nodes being sent unencrypted when traffic matches Layer 7 policies. This issue can expose sensitive data as it travels between nodes within the cluster.
CPE | Name | Operator | Version |
---|---|---|---|
github.com/cilium/cilium | le | 1.15.1 | |
github.com/cilium/cilium | le | 1.14.7 | |
github.com/cilium/cilium | le | 1.15.1 | |
github.com/cilium/cilium | le | 1.14.7 |
github.com/advisories/GHSA-v6q2-4qr3-5cw6
github.com/cilium/cilium/commit/036e4585f96347c21bd78a3cd06669b47fa6dea5
github.com/cilium/cilium/releases/tag/v1.13.13
github.com/cilium/cilium/releases/tag/v1.14.8
github.com/cilium/cilium/releases/tag/v1.15.2
github.com/cilium/cilium/security/advisories/GHSA-v6q2-4qr3-5cw6
6.1 Medium
CVSS3
Attack Vector
ADJACENT
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
6.6 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.5%