CVE-2024-23327 Crash in proxy protocol when command type of LOCAL in Envoy

2024-02-0922:41:54

CWE-476

GitHub_M

www.cve.org

cve-2024-23327

proxy protocol

envoy

vulnerability

upgrade

segfault

ppv2 header

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CNA Affected

[
  {
    "vendor": "envoyproxy",
    "product": "envoy",
    "versions": [
      {
        "version": ">= 1.29.0, < 1.29.1",
        "status": "affected"
      },
      {
        "version": ">= 1.28.0, < 1.28.1",
        "status": "affected"
      },
      {
        "version": ">= 1.27.0, < 1.27.3",
        "status": "affected"
      },
      {
        "version": "< 1.26.7",
        "status": "affected"
      }
    ]
  }
]