CVE-2024-28249: Unencrypted traffic between nodes when using IPsec and L7 policies

In Cilium clusters with IPsec enabled and traffic matching Layer 7 policies:

• Traffic that should be IPsec-encrypted between a node’s Envoy proxy and pods on other nodes is sent unencrypted
• Traffic that should be IPsec-encrypted between a node’s DNS proxy and pods on other nodes is sent unencrypted

Note: For clusters running in native routing mode, IPsec encryption is not applied to connections which are selected by a L7 Egress Network Policy or a DNS Policy. This is a known limitation of Cilium’s IPsec encryption which will continue to apply after upgrading to the latest Cilium versions described below.