PT-2024-9686 · Envoy · Envoy

Phlax · Published 2024-11-19 · Updated 2024-12-20 · CVE-2024-53271

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.31.5 Envoy versions prior to 1.32.3

Description The issue is related to the incorrect implementation of the control flow when handling HTTP responses in the Envoy proxy server. This can lead to downstream failures in networked devices. The problem arises from Envoy not properly handling HTTP 1.1 non-101 1xx responses.

Recommendations For Envoy versions prior to 1.31.5, upgrade to version 1.31.5 or later. For Envoy versions prior to 1.32.3, upgrade to version 1.32.3 or later. As a temporary workaround, consider restricting the use of HTTP 1.1 non-101 1xx responses until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-670

Related Identifiers

BDU:2024-11398

BIT-ENVOY-2024-53271

CVE-2024-53271

GHSA-RMM5-H2WV-MG4F

Affected Products

Envoy

References · 12

• 🔥 https://github.com/envoyproxy/envoy/security/advisories/GHSA-rmm5-h2wv-mg4f · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53271.json · Exploit
• https://github.com/envoyproxy/envoy/commit/da56f6da63079baecef9183436ee5f4141a59af8 · Patch
• https://osv.dev/vulnerability/CVE-2024-53271 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53271 · Security Note
• https://bdu.fstec.ru/vul/2024-11398 · Security Note
• https://osv.dev/vulnerability/BIT-envoy-2024-53271 · Vendor Advisory
• https://t.me/cvenotify/104820 · Telegram Post
• https://twitter.com/CVEnew/status/1869463855685890142 · Twitter Post
• https://t.me/cvedetector/13241 · Telegram Post
• https://vuldb.com/ru/?id.288887 · Note
• https://twitter.com/VulmonFeeds/status/1869550175795937366 · Twitter Post