Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2024-23326 #2890

Closed
tatianab opened this issue Jun 7, 2024 · 1 comment
Closed

x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2024-23326 #2890

tatianab opened this issue Jun 7, 2024 · 1 comment
Labels
excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. triaged

Comments

@tatianab
Copy link
Contributor

tatianab commented Jun 7, 2024

CVE-2024-23326 references github.com/envoyproxy/envoy, which may be a Go module.

Description:
Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch. This opens up the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response.

References:

Cross references:

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/envoyproxy/envoy
      vulnerable_at: 1.30.2
      packages:
        - package: envoy
summary: CVE-2024-23326 in github.com/envoyproxy/envoy
cves:
    - CVE-2024-23326
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-23326
    - web: https://github.com/envoyproxy/envoy/security/advisories/GHSA-vcf8-7238-v74c
source:
    id: CVE-2024-23326
    created: 2024-06-07T17:17:48.870801-04:00
review_status: UNREVIEWED
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592765 mentions this issue: data/excluded,data/reports: add 10 reports

@GoVulnBot GoVulnBot mentioned this issue Jul 1, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@tatianab @gopherbot