Information Exposure Affecting github.com/cilium/cilium/bugtool/cmd package, versions >=1.13.0 <1.13.17 >=1.14.0 <1.14.12 >=1.15.0 <1.15.6
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMCILIUMCILIUMBUGTOOLCMD-7252134
- published 14 Jun 2024
- disclosed 13 Jun 2024
- credit Tam Mach
Introduced: 13 Jun 2024
CVE-2024-37307 Open this link in a new tabHow to fix?
Upgrade github.com/cilium/cilium/bugtool/cmd to version 1.13.17, 1.14.12, 1.15.6 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure through the cilium-bugtool when the --envoy-dump flag is used. An attacker can access sensitive data by exploiting this vulnerability.
Notes:
Users of the following features are affected:
TLS inspection
Ingress with TLS termination
Gateway API with TLS termination
Kafka network policies with API key filtering
The sensitive data includes:
The CA certificate, certificate chain, and private key used by Cilium HTTP Network Policies, and when using Ingress/Gateway API
The API keys used in Kafka-related network policy
cilium-bugtool is a debugging tool that is typically invoked manually and does not run during the normal operation of a Cilium cluster.