CVE-2024-23327CWE-476

Crash in proxy protocol when command type of LOCAL in Envoy

High · published February 9, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
52.4
In the wild
Unconfirmed
What it is

Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00693 · 52.4th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2024-02-09T22:41Z
EPSS history
Timeline
  • 09 FEB 22:41Z
    Crash in proxy protocol when command type of LOCAL in Envoy
    cvelistv5