CVE-2024-52529

Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in Cilium

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that selects a Layer 3 destination and a port range `AND` 2. A Layer 7 allow policy that selects a specific port within the first policy's range the Layer 7 enforcement would not occur for the traffic selected by the Layer 7 policy. This issue only affects users who use Cilium's port range functionality, which was introduced in Cilium v1.16. This issue is patched in PR #35150. This issue affects Cilium v1.16 between v1.16.0 and v1.16.3 inclusive. This issue is patched in Cilium v1.16.4. Users are advised to upgrade. Users with network policies that match the pattern described above can work around the issue by rewriting any policies that use port ranges to individually specify the ports permitted for traffic.

Category

5.8
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.02%
Affected: cilium cilium
Published at:
Updated at:

References

Link Tags
https://github.com/cilium/cilium/security/advisories/GHSA-xg58-75qf-9r67
https://github.com/cilium/cilium/pull/35150

Frequently Asked Questions

What is the severity of CVE-2024-52529?
CVE-2024-52529 has been scored as a medium severity vulnerability.
How to fix CVE-2024-52529?
To fix CVE-2024-52529, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-52529 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-52529 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-52529?
CVE-2024-52529 affects cilium cilium.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.