CVE-2024-32475
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2024-32475 is a vulnerability affecting Envoy, an open-source edge and service proxy. The vulnerability occurs when an upstream TLS cluster is used with `auto_sni` enabled, and a request containing a `host`/`:authority` header longer than 255 characters is sent, causing an abnormal termination of the Envoy process. This issue arises from Envoy's inability to gracefully handle errors when setting the Server Name Indication (SNI) for outbound TLS connections. The SNI length is limited to 255 characters according to the standard, but Envoy fails to handle this limitation properly, resulting in process termination. To remediate this vulnerability, users are advised to update their Envoy version to 1.30.1, 1.29.4, 1.28.3, or 1.27.5. The potential danger of this vulnerability lies in the fact that it can lead to service disruptions and potential security breaches in organizations utilizing Envoy for their cloud-native environments.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions