CVE-2024-45808

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-45808
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45808.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-45808
Aliases
Published
2024-09-19T23:34:26.714Z
Modified
2026-07-15T01:49:17.935554690Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Malicious log injection via access logs in envoy
Details

Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the REQUESTED_SERVER_NAME field for access loggers. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cwe_ids": [
        "CWE-117"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45808.json"
}
References

Affected packages

Git / github.com/envoyproxy/envoy

Affected ranges

Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4848d6d548438b50d6d78187a7cfbe61e02d8b85
Introduced
a6d1d66a62b985baed414ba90ad0daebfc074664
Fixed
94aa5f7f82fb543e7fbc011ea398ac12cc396817
Introduced
50ea83e602d5da162df89fd5798301e22f5540cf
Fixed
810bfcb8cae456e3a5e6541a0ee853185e2586f7
Introduced
7b8baff1758f0a584dcc3cb657b5032000bcb3d7
Fixed
cc4a75482810de4b84c301d13deb551bd3147339
Database specific 
{
    "cpe": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.28.7"
        },
        {
            "introduced": "1.29.0"
        },
        {
            "fixed": "1.29.9"
        },
        {
            "introduced": "1.30.0"
        },
        {
            "fixed": "1.30.6"
        },
        {
            "introduced": "1.31.0"
        },
        {
            "fixed": "1.31.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.28.1
v1.28.2
v1.28.3
v1.28.4
v1.28.5
v1.28.6
v1.29.0
v1.29.1
v1.29.2
v1.29.3
v1.29.4
v1.29.5
v1.29.6
v1.29.7
v1.29.8
v1.3.0
v1.30.0
v1.30.1
v1.30.2
v1.30.3
v1.30.4
v1.30.5
v1.31.0
v1.31.1
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45808.json"