Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2024-45809 #3148

Closed
GoVulnBot opened this issue Sep 20, 2024 · 1 comment
Closed

x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2024-45809 #3148

GoVulnBot opened this issue Sep 20, 2024 · 1 comment
Assignees
@zpavlinovic
Labels
excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. triaged

Comments

@GoVulnBot
Copy link

Advisory CVE-2024-45809 references a vulnerability in the following Go modules:

Module
github.com/envoyproxy/envoy

Description:
Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remote JWKs. In the following case: 1. remote JWKs are used, which requires async header processing; 2. clear_route_cache is enabled on the provider; 3. header operations are enabled in JWT filter, e.g. header to claims feature; 4. the routing table is configured in a way that the JWT header operations modify requests to not match any route. When these conditions are met, a crash is triggered in the upstream code due to nullptr reference conversion from route()...

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/envoyproxy/envoy
      vulnerable_at: 1.31.2
summary: CVE-2024-45809 in github.com/envoyproxy/envoy
cves:
    - CVE-2024-45809
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-45809
    - web: https://github.com/envoyproxy/envoy/security/advisories/GHSA-wqr5-qmq7-3qw3
source:
    id: CVE-2024-45809
    created: 2024-09-20T01:01:22.829587166Z
review_status: UNREVIEWED
@zpavlinovic zpavlinovic self-assigned this Sep 20, 2024
@zpavlinovic zpavlinovic added excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. and removed possibly not Go labels Sep 20, 2024
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/614715 mentions this issue: data/excluded: add 6 reports

# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees

@zpavlinovic zpavlinovic

Labels
excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@zpavlinovic @gopherbot @GoVulnBot