Envoy Crashes in Proxy Protocol with IPv6 Addresses
CVE-2024-23325
What is CVE-2024-23325?
Envoy, a high-performance edge and service proxy, contains a vulnerability that leads to crashes when processing requests with unsupported address types, particularly under certain network configurations. This issue arises when a host has IPv6 functionality disabled while configured with a listener utilizing the proxy protocol. When a client presents its IPv6 address, Envoy becomes susceptible to crashing, despite the underlying connection possibly being IPv4 only. This vulnerability has been resolved in versions 1.26.7, 1.27.3, 1.28.1, and 1.29.1, and users are strongly encouraged to update to these releases as there are currently no workarounds available.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
envoy >= 1.29.0, < 1.29.1 < 1.29.0, 1.29.1
envoy >= 1.28.0, < 1.28.1 < 1.28.0, 1.28.1
envoy >= 1.27.0, < 1.27.3 < 1.27.0, 1.27.3
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved