CVE-2024-32475

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Apr 18, 2024
CWE ID 253
CWE ID 617

Summary

CVE-2024-32475 is a vulnerability affecting Envoy, an open-source edge and service proxy. The vulnerability occurs when an upstream TLS cluster is used with auto_sni enabled, and a request containing a host/:authority header longer than 255 characters is sent, causing an abnormal termination of the Envoy process. This issue arises from Envoy's inability to gracefully handle errors when setting the Server Name Indication (SNI) for outbound TLS connections. The SNI length is limited to 255 characters according to the standard, but Envoy fails to handle this limitation properly, resulting in process termination. To remediate this vulnerability, users are advised to update their Envoy version to 1.30.1, 1.29.4, 1.28.3, or 1.27.5. The potential danger of this vulnerability lies in the fact that it can lead to service disruptions and potential security breaches in organizations utilizing Envoy for their cloud-native environments.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-32475 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options