Detections
Analytics

SCA: security update for github.com/cilium/cilium (GHSA-q7w8-72mr-vpgw)

medium Tenable Self-Hosted Container Security Plugin ID 417977

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to
 versions 1.14.14 and 1.15.8, a race condition in the Cilium agent can cause the agent to ignore labels
 that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for
 nodes with the ignored label to not apply, leading to policy bypass. This issue has been patched in Cilium
 v1.14.14 and v1.15.8 As the underlying issue depends on a race condition, users unable to upgrade can
 restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as
 expected. (CVE-2024-42488)

See Also

https://github.com/advisories/GHSA-q7w8-72mr-vpgw

Plugin Details

Severity: Medium

ID: 417977

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 6/30/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 51.16

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2024-42488

CVSS v3

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/15/2024

Vulnerability Publication Date: 8/15/2024

Reference Information

CVE: CVE-2024-42488

cwe: CWE-362