PT-2024-31791 · Envoy · Envoy
Vandycknick
·
Published
2024-09-19
·
Updated
2024-09-24
·
CVE-2024-45810
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Envoy versions prior to 1.28.7
Envoy versions prior to 1.29.9
Envoy versions prior to 1.30.6
Envoy versions prior to 1.31.2
Description:
Envoy is a cloud-native high-performance edge/middle/service proxy. The http async client will crash when handling
sendLocalReply under certain circumstances, such as websocket upgrade and requests mirroring. This occurs due to the duplication of the status code and the destruction of the router being called at the destructor of the async stream. The stream decoder is destroyed, but its reference is called in router.onDestroy(), causing a segment fault. This issue impacts ext authz if the upgrade and connection header are allowed, and request mirroring.Recommendations:
For Envoy versions prior to 1.28.7, upgrade to version 1.28.7 or later.
For Envoy versions prior to 1.29.9, upgrade to version 1.29.9 or later.
For Envoy versions prior to 1.30.6, upgrade to version 1.30.6 or later.
For Envoy versions prior to 1.31.2, upgrade to version 1.31.2 or later.
Exploit
Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Envoy