CVE-2024-23327

CVSS 3.1 Score 7.5 of 10 (high)

Attack Complexity low
Availability high
Confidentiality none
Integrity none
Scope unchanged
Privileges Required none

Details

Published Feb 9, 2024
Updated: Feb 15, 2024
CWE ID 476

Summary

CVE-2024-23327 is a vulnerability affecting Envoy, a high-performance edge/middle/service proxy. When Proxy Protocol version 2 (PPv2) is enabled on both a listener and subsequent cluster, the Envoy instance will experience a segfault when processing certain requests. This occurs specifically when the downstream request lacks the protocol block and its command type is LOCAL. The affected versions include 1.26.7, 1.27.3, 1.28.1, and 1.29.1. To mitigate this issue, users are advised to upgrade to the addressed versions. No known workarounds are available for this vulnerability.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share