Envoy up to 1.30.7/1.31.3/1.32.1 IP Configuration control flow

Summaryinfo

A vulnerability identified as problematic has been detected in Envoy up to 1.30.7/1.31.3/1.32.1. This vulnerability affects unknown code of the component IP Configuration Handler. Performing a manipulation results in control flow. This vulnerability is known as CVE-2024-53269. Access to the local network is required for this attack. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Envoy up to 1.30.7/1.31.3/1.32.1. This affects some unknown functionality of the component IP Configuration Handler. The manipulation with an unknown input leads to a control flow vulnerability. CWE is classifying the issue as CWE-670. The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated. This is going to have an impact on availability. The summary by CVE is:

Envoy is a cloud-native high-performance edge/middle/service proxy. When additional address are not ip addresses, then the Happy Eyeballs sorting algorithm will crash in data plane. This issue has been addressed in releases 1.32.2, 1.31.4, and 1.30.8. Users are advised to upgrade. Users unable to upgrade may disable Happy Eyeballs and/or change the IP configuration.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2024-53269 since 11/19/2024. The exploitability is told to be easy. The attack can only be initiated within the local network. The exploitation requires an enhanced level of successful authentication. Neither technical details nor an exploit are publicly available.

Upgrading to version 1.30.8, 1.31.4 or 1.32.2 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Envoy

Version

• 1.30.0
• 1.30.1
• 1.30.2
• 1.30.3
• 1.30.4
• 1.30.5
• 1.30.6
• 1.30.7
• 1.31.0
• 1.31.1
• 1.31.2
• 1.31.3
• 1.32.0
• 1.32.1

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion