PT-2024-25822 · Envoy · Envoy

Paul Ogilby · Published 2024-06-04 · Updated 2024-07-11 · CVE-2024-34364

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Envoy (affected versions not specified)

Description The issue is related to an out-of-memory (OOM) vector exposed by Envoy, a cloud-native, open source edge and service proxy. This occurs because the async HTTP client buffers the response with an unbounded buffer, specifically from the mirror response.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Memory Corruption

Weakness Enumeration

CWE-400

CWE-787

Related Identifiers

BIT-ENVOY-2024-34364

CVE-2024-34364

GHSA-XCJ3-H7VF-FW26

Affected Products

Envoy

References · 8

• 🔥 https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcj3-h7vf-fw26 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34364.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-34364 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34364 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-envoy-2024-34364 · Vendor Advisory
• https://t.me/cvenotify/82008 · Telegram Post
• https://t.me/cvenotify/82849 · Telegram Post
• https://twitter.com/gcpweekly/status/1811437999726510450 · Twitter Post