CVE-2025-64715

Katalog CVE

CVSS 5.5 · Medium EPSS 0,17%

Kerentanan Improper Access Control pada cilium. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicys which use egress.toGroups.aws.securityGroupsIds to reference AWS security group IDs that do not exist or are not attached to any network interface may unintentionally allow broader outbound access than intended by the policy authors. In such cases, the toCIDRset section of the derived policy is not generated, which means outbound traffic may be permitted to more destinations than originally intended. This issue has been patched in versions 1.16.17, 1.17.10, and 1.18.4. There are no workarounds for this issue.

Rincian

Terbit di NVD

29 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 6,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cilium/cilium/security/advisories/GHSA-38pp-6gcp-rqvm patch · advisory vendor
• https://github.com/cilium/cilium/commit/a385856b59c8289cc7273fa3a3062bbf0ef96c97 patch
• https://github.com/cilium/cilium/releases/tag/v1.16.17 release notes
• https://github.com/cilium/cilium/releases/tag/v1.17.10 release notes
• https://github.com/cilium/cilium/releases/tag/v1.18.4 release notes