CVE-2024-23327

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-23327
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23327.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-23327
Aliases
Published
2024-02-09T22:41:54.896Z
Modified
2025-12-05T03:14:08.418361Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Crash in proxy protocol when command type of LOCAL in Envoy
Details

Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-476"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23327.json"
}
References

Affected packages

Git / github.com/envoyproxy/envoy

Affected ranges

Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
a6d1d66a62b985baed414ba90ad0daebfc074664
Fixed
4fda4d79d06e1bd59e591be3f348223495083648
Database specific 
{
    "versions": [
        {
            "introduced": "1.29.0"
        },
        {
            "fixed": "1.29.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
b5ca88acee3453c9459474b8f22215796eff4dde
Fixed
0de8b2b94c75dbe8c2f897058e16d23d959783fa
Database specific 
{
    "versions": [
        {
            "introduced": "1.28.0"
        },
        {
            "fixed": "1.28.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
7bba38b743bb3bca22dffb4a21c38ccc155fbef8
Fixed
0fd81ee7ffcd7cfc864094b24dc9b5c3ade89ff2
Database specific 
{
    "versions": [
        {
            "introduced": "1.27.0"
        },
        {
            "fixed": "1.27.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a0e580408ef4568b0a16c6663b6d8ae0c46aba6a
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.26.7"
        }
    ]
}

Affected versions

v1.*

v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.26.1
v1.26.2
v1.26.3
v1.26.4
v1.26.5
v1.26.6
v1.27.0
v1.27.1
v1.27.2
v1.28.0
v1.29.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0