Published: 09/02/2024 Updated: 15/02/2024

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 0

Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerable Product	Search on Vulmon	Subscribe to Product
envoyproxy envoy

Envoy is a high-performance edge/middle/service proxy Envoy will crash when certain timeouts happen within the same interval The crash occurs when the following are true: 1 hedge_on_per_try_timeout is enabled, 2 per_try_idle_timeout is enabled (it can only be done in configuration), 3 per-try-timeout is enabled, either through headers or confi ...

CWE-476 https://github.com/envoyproxy/envoy/security/advisories/GHSA-4h5x-x9vh-m29j https://github.com/envoyproxy/envoy/commit/63895ea8e3cca9c5d3ab4c5c128ed1369969d54a https://nvd.nist.gov https://alas.aws.amazon.com/AL2/ALASECS-2024-034.html

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2024-23327

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect