Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-23327

Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Published

2024-02-09T23:15:09.647

Last Modified

2024-11-21T08:57:31.030

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

Weaknesses

Type: Primary
CWE-476

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	envoyproxy	envoy	< 1.26.7	Yes
Application	envoyproxy	envoy	< 1.27.3	Yes
Application	envoyproxy	envoy	< 1.28.1	Yes
Application	envoyproxy	envoy	< 1.29.1	Yes

References

https://github.com/envoyproxy/envoy/commit/63895ea8e3cca9c5d3ab4c5c128ed1369969d54a Patch, Third Party Advisory ([email protected])
https://github.com/envoyproxy/envoy/security/advisories/GHSA-4h5x-x9vh-m29j Third Party Advisory ([email protected])
https://github.com/envoyproxy/envoy/commit/63895ea8e3cca9c5d3ab4c5c128ed1369969d54a Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/envoyproxy/envoy/security/advisories/GHSA-4h5x-x9vh-m29j Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)