CVE-2024-23327
- ULN >
- Oracle Linux CVE repository >
- CVE-2024-23327
CVE Details
| Release Date: | 2024-02-09 |
Description
Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
See more information about CVE-2024-23327 from MITRE CVE dictionary and NIST NVD
CVSS v3.0 metrics
NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.
| Base Score: | 7.5 | Base Metrics: | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Access Vector: | Network | Attack Complexity: | Low |
| Privileges Required: | None | User Interaction: | None |
| Scope: | Unchanged | Confidentiality Impact: | None |
| Integrity Impact: | None | Availability Impact: | High |
Errata information
| Platform | Errata | Release Date |
| Oracle Linux version 7 (cri-o) | ELSA-2024-12329 | 2024-04-16 |
| Oracle Linux version 7 (cri-tools) | ELSA-2024-12329 | 2024-04-16 |
| Oracle Linux version 7 (etcd) | ELSA-2024-12329 | 2024-04-16 |
| Oracle Linux version 7 (istio) | ELSA-2024-12329 | 2024-04-16 |
| Oracle Linux version 7 (kubernetes) | ELSA-2024-12329 | 2024-04-16 |
| Oracle Linux version 7 (olcne) | ELSA-2024-12329 | 2024-04-16 |
| Oracle Linux version 8 (cri-o) | ELSA-2024-12328 | 2024-04-16 |
| Oracle Linux version 8 (cri-o) | ELSA-2024-12348 | 2024-04-26 |
| Oracle Linux version 8 (cri-tools) | ELSA-2024-12328 | 2024-04-16 |
| Oracle Linux version 8 (cri-tools) | ELSA-2024-12348 | 2024-04-26 |
| Oracle Linux version 8 (etcd) | ELSA-2024-12328 | 2024-04-16 |
| Oracle Linux version 8 (etcd) | ELSA-2024-12348 | 2024-04-26 |
| Oracle Linux version 8 (istio) | ELSA-2024-12328 | 2024-04-16 |
| Oracle Linux version 8 (istio) | ELSA-2024-12348 | 2024-04-26 |
| Oracle Linux version 8 (kubernetes) | ELSA-2024-12328 | 2024-04-16 |
| Oracle Linux version 8 (kubernetes) | ELSA-2024-12348 | 2024-04-26 |
| Oracle Linux version 8 (olcne) | ELSA-2024-12328 | 2024-04-16 |
| Oracle Linux version 8 (olcne) | ELSA-2024-12348 | 2024-04-26 |
| Oracle Linux version 9 (cri-o) | ELSA-2024-12347 | 2024-04-26 |
| Oracle Linux version 9 (cri-tools) | ELSA-2024-12347 | 2024-04-26 |
| Oracle Linux version 9 (etcd) | ELSA-2024-12347 | 2024-04-26 |
| Oracle Linux version 9 (istio) | ELSA-2024-12347 | 2024-04-26 |
| Oracle Linux version 9 (kubernetes) | ELSA-2024-12347 | 2024-04-26 |
| Oracle Linux version 9 (olcne) | ELSA-2024-12347 | 2024-04-26 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team
