Envoy Proxy Segfaults with PPv2 and LOCAL Requests
CVE-2024-23327

7.5HIGH

Key Information:

Vendor

Envoyproxy

Status
Envoy
Vendor
CVE Published:
9 February 2024

What is CVE-2024-23327?

A vulnerability has been identified in the Envoy Proxy service, where enabling PPv2 on both listeners and subsequent clusters may cause Envoy to experience a segmentation fault during upstream header crafting. This issue particularly arises when a downstream request is made with a LOCAL command type without a accompanying protocol block. The Envoy Project has issued patches in versions 1.29.1, 1.28.1, 1.27.3, and 1.26.7 to resolve this issue. Users are strongly encouraged to upgrade their installations, as there are currently no workarounds available for this vulnerability.

Affected Version(s)

envoy >= 1.29.0, < 1.29.1 < 1.29.0, 1.29.1

envoy >= 1.28.0, < 1.28.1 < 1.28.0, 1.28.1

envoy >= 1.27.0, < 1.27.3 < 1.27.0, 1.27.3

References

https://github.com/envoyproxy/envoy/security/advisories/G...
x_refsource_CONFIRM
https://github.com/envoyproxy/envoy/commit/63895ea8e3cca9...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.