PT-2024-31791 · Envoy · Envoy

Vandycknick

·

Published

2024-09-19

·

Updated

2024-09-24

·

CVE-2024-45810

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.28.7 Envoy versions prior to 1.29.9 Envoy versions prior to 1.30.6 Envoy versions prior to 1.31.2
Description: Envoy is a cloud-native high-performance edge/middle/service proxy. The http async client will crash when handling sendLocalReply under certain circumstances, such as websocket upgrade and requests mirroring. This occurs due to the duplication of the status code and the destruction of the router being called at the destructor of the async stream. The stream decoder is destroyed, but its reference is called in router.onDestroy(), causing a segment fault. This issue impacts ext authz if the upgrade and connection header are allowed, and request mirroring.
Recommendations: For Envoy versions prior to 1.28.7, upgrade to version 1.28.7 or later. For Envoy versions prior to 1.29.9, upgrade to version 1.29.9 or later. For Envoy versions prior to 1.30.6, upgrade to version 1.30.6 or later. For Envoy versions prior to 1.31.2, upgrade to version 1.31.2 or later.

Exploit

Fix

Buffer Overflow

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BIT-ENVOY-2024-45810
CVE-2024-45810
GHSA-QM74-X36M-555Q

Affected Products

Envoy