CVE-2024-23327

2024-02-0923:15:09

CWE-476

GitHub_M

web.nvd.nist.gov

envoy

high-performance

proxy

cve-2024-23327

security vulnerability

ppv2

upgrade

nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

17.0%

JSON

Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected configurations

Nvd

Vulners

Node

envoyproxyenvoyRange1.26.0–1.26.7

envoyproxyenvoyRange1.27.0–1.27.3

envoyproxyenvoyRange1.28.0–1.28.1

envoyproxyenvoyRange1.29.0–1.29.1

VendorProductVersionCPE
envoyproxyenvoy*cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
envoyproxy	envoy	*	cpe:2.3:a:envoyproxy:envoy::::::::

CNA Affected

[
  {
    "vendor": "envoyproxy",
    "product": "envoy",
    "versions": [
      {
        "version": ">= 1.29.0, < 1.29.1",
        "status": "affected"
      },
      {
        "version": ">= 1.28.0, < 1.28.1",
        "status": "affected"
      },
      {
        "version": ">= 1.27.0, < 1.27.3",
        "status": "affected"
      },
      {
        "version": "< 1.26.7",
        "status": "affected"
      }
    ]
  }
]