envoyproxy envoy up to 1.26.6/1.27.2/1.28.0/1.29.0 resource consumption

Summaryinfo

A vulnerability was found in envoyproxy envoy up to 1.26.6/1.27.2/1.28.0/1.29.0. It has been classified as problematic. This affects an unknown function. The manipulation leads to resource consumption. This vulnerability is traded as CVE-2024-23323. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in envoyproxy envoy up to 1.26.6/1.27.2/1.28.0/1.29.0 (Firewall Software). It has been rated as problematic. This issue affects an unknown code block. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased request latency when multiple routes are configured with such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was shared 02/10/2024 as GHSA-x278-4w4x-r7ch. The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-23323 since 01/15/2024. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 1.26.7, 1.27.3, 1.28.1 or 1.29.1 eliminates this vulnerability. Applying the patch 71eeee8f0f0132f39e402b0ee23b361ee2f4e645 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Firewall Software

Vendor

• envoyproxy

Name

• envoy

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.26.0
• 1.26.1
• 1.26.2
• 1.26.3
• 1.26.4
• 1.26.5
• 1.26.6
• 1.27
• 1.27.0
• 1.27.1
• 1.27.2
• 1.28
• 1.28.0
• 1.29.0

License

• free

Website

• Product: https://github.com/envoyproxy/envoy/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion