{"url":"http://public2.vulnerablecode.io/api/packages/373087?format=json","purl":"pkg:golang/github.com/cilium/cilium@1.15.6","type":"golang","namespace":"github.com/cilium","name":"cilium","version":"1.15.6","qualifiers":{},"subpath":"","is_vulnerable":false,"next_non_vulnerable_version":"1.15.8","latest_non_vulnerable_version":"1.19.3","affected_by_vulnerabilities":[],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/44927?format=json","vulnerability_id":"VCID-tz4h-r9ym-y3e4","summary":"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.13.0 and prior to versions 1.13.7, 1.14.12, and 1.15.6, the output of `cilium-bugtool` can contain sensitive data when the tool is run (with the `--envoy-dump` flag set) against Cilium deployments with the Envoy proxy enabled. Users of the TLS inspection, Ingress with TLS termination, Gateway API with TLS termination, and Kafka network policies with API key filtering features are affected. The sensitive data includes the CA certificate, certificate chain, and private key used by Cilium HTTP Network Policies, and when using Ingress/Gateway API and the API keys used in Kafka-related network policy. `cilium-bugtool` is a debugging tool that is typically invoked manually and does not run during the normal operation of a Cilium cluster. This issue has been patched in Cilium v1.15.6, v1.14.12, and v1.13.17. There is no workaround to this issue.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-37307","reference_id":"","reference_type":"","scores":[{"value":"0.00049","scoring_system":"epss","scoring_elements":"0.15774","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-37307"},{"reference_url":"https://github.com/cilium/cilium","reference_id":"","reference_type":"","scores":[{"value":"7.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/cilium/cilium"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37307","reference_id":"","reference_type":"","scores":[{"value":"7.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37307"},{"reference_url":"https://pkg.go.dev/vuln/GO-2024-2922","reference_id":"","reference_type":"","scores":[{"value":"7.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://pkg.go.dev/vuln/GO-2024-2922"},{"reference_url":"https://github.com/cilium/cilium/commit/0191b1ebcfdd61cefd06da0315a0e7d504167407","reference_id":"0191b1ebcfdd61cefd06da0315a0e7d504167407","reference_type":"","scores":[{"value":"7.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-08-19T17:02:42Z/"}],"url":"https://github.com/cilium/cilium/commit/0191b1ebcfdd61cefd06da0315a0e7d504167407"},{"reference_url":"https://github.com/cilium/cilium/commit/224e288a5bf40d0bb0f16c9413693b319633431a","reference_id":"224e288a5bf40d0bb0f16c9413693b319633431a","reference_type":"","scores":[{"value":"7.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-08-19T17:02:42Z/"}],"url":"https://github.com/cilium/cilium/commit/224e288a5bf40d0bb0f16c9413693b319633431a"},{"reference_url":"https://github.com/cilium/cilium/commit/9299c0fd0024e33397cffc666ff851e82af28741","reference_id":"9299c0fd0024e33397cffc666ff851e82af28741","reference_type":"","scores":[{"value":"7.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-08-19T17:02:42Z/"}],"url":"https://github.com/cilium/cilium/commit/9299c0fd0024e33397cffc666ff851e82af28741"},{"reference_url":"https://github.com/cilium/cilium/commit/958d7b77274bf2c272d8cdfd812631d644250653","reference_id":"958d7b77274bf2c272d8cdfd812631d644250653","reference_type":"","scores":[{"value":"7.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-08-19T17:02:42Z/"}],"url":"https://github.com/cilium/cilium/commit/958d7b77274bf2c272d8cdfd812631d644250653"},{"reference_url":"https://github.com/cilium/cilium/commit/9eb25ba40391a9b035d7e66401b862818f4aac4b","reference_id":"9eb25ba40391a9b035d7e66401b862818f4aac4b","reference_type":"","scores":[{"value":"7.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-08-19T17:02:42Z/"}],"url":"https://github.com/cilium/cilium/commit/9eb25ba40391a9b035d7e66401b862818f4aac4b"},{"reference_url":"https://github.com/cilium/cilium/commit/bf9a1ae1b2d2b2c9cca329d7aa96aa4858032a61","reference_id":"bf9a1ae1b2d2b2c9cca329d7aa96aa4858032a61","reference_type":"","scores":[{"value":"7.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-08-19T17:02:42Z/"}],"url":"https://github.com/cilium/cilium/commit/bf9a1ae1b2d2b2c9cca329d7aa96aa4858032a61"},{"reference_url":"https://github.com/cilium/cilium/security/advisories/GHSA-wh78-7948-358j","reference_id":"GHSA-wh78-7948-358j","reference_type":"","scores":[{"value":"7.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-08-19T17:02:42Z/"}],"url":"https://github.com/cilium/cilium/security/advisories/GHSA-wh78-7948-358j"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/373085?format=json","purl":"pkg:golang/github.com/cilium/cilium@1.13.17","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:golang/github.com/cilium/cilium@1.13.17"},{"url":"http://public2.vulnerablecode.io/api/packages/373086?format=json","purl":"pkg:golang/github.com/cilium/cilium@1.14.12","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:golang/github.com/cilium/cilium@1.14.12"},{"url":"http://public2.vulnerablecode.io/api/packages/373087?format=json","purl":"pkg:golang/github.com/cilium/cilium@1.15.6","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:golang/github.com/cilium/cilium@1.15.6"}],"aliases":["CVE-2024-37307","GHSA-wh78-7948-358j"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-tz4h-r9ym-y3e4"}],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:golang/github.com/cilium/cilium@1.15.6"}