VYPR
← All advisories
Moderate severityNVD Advisory· Published Oct 21, 2024· Updated Oct 21, 2024

CIDR deny policies may not take effect when a more narrow CIDR allow is present

CVE-2024-47825

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than /32 may be ignored if there is a policy rule referencing a more narrow prefix (CIDRSet or toFQDN) and this narrower policy rule specifies either enableDefaultDeny: false or - toEntities: all. Note that a rule specifying toEntities: world or toEntities: 0.0.0.0/0 is insufficient, it must be to entity all.This issue has been patched in Cilium v1.14.16 and v1.15.10. As this issue only affects policies using enableDefaultDeny: false or that set toEntities to all, some workarounds are available. For users with policies using enableDefaultDeny: false, remove this configuration option and explicitly define any allow rules required. For users with egress policies that explicitly specify toEntities: all, use toEntities: world.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/cilium/ciliumGo
>= 1.15.0, < 1.15.101.15.10
github.com/cilium/ciliumGo
>= 1.14.0, < 1.14.161.14.16

Affected products

64

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.