Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2024-39305 #2960

Closed
GoVulnBot opened this issue Jul 1, 2024 · 1 comment
Closed

x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2024-39305 #2960

GoVulnBot opened this issue Jul 1, 2024 · 1 comment
Assignees
@tatianab
Labels
excluded: NOT_GO_CODE This vulnerability does not refer to a Go module.

Comments

@GoVulnBot
Copy link

Advisory CVE-2024-39305 references a vulnerability in the following Go modules:

Module
github.com/envoyproxy/envoy

Description:
Envoy is a cloud-native, open source edge and service proxy. Prior to versions 1.30.4, 1.29.7, 1.28.5, and 1.27.7. Envoy references already freed memory when route hash policy is configured with cookie attributes. Note that this vulnerability has been fixed in the open as the effect would be immediately apparent if it was configured. Memory allocated for holding attribute values is freed after configuration was parsed. During request processing Envoy will attempt to copy content of de-allocated memory into request cookie header. This can lead to arbitrary content of Envoy's memory to be sent t...

References:

Cross references:

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/envoyproxy/envoy
      vulnerable_at: 1.30.4
summary: CVE-2024-39305 in github.com/envoyproxy/envoy
cves:
    - CVE-2024-39305
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-39305
    - fix: https://github.com/envoyproxy/envoy/commit/02a06681fbe0e039b1c7a9215257a7537eddb518
    - fix: https://github.com/envoyproxy/envoy/commit/50b384cb203a1f2894324cbae64b6d9bc44cce45
    - fix: https://github.com/envoyproxy/envoy/commit/99b6e525fb9f6f6f19a0425f779bc776f121c7e5
    - fix: https://github.com/envoyproxy/envoy/commit/b7f509607ad860fd6a63cde4f7d6f0197f9f63bb
    - web: https://github.com/envoyproxy/envoy/security/advisories/GHSA-fp35-g349-h66f
source:
    id: CVE-2024-39305
    created: 2024-07-01T23:01:14.816972359Z
review_status: UNREVIEWED
@tatianab tatianab added the excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. label Jul 2, 2024
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/595965 mentions this issue: data/excluded: add GO-2024-2960

@tatianab tatianab self-assigned this Jul 2, 2024
This was referenced Sep 20, 2024
Closed
Closed
Closed
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tatianab tatianab

Labels
excluded: NOT_GO_CODE This vulnerability does not refer to a Go module.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@tatianab @gopherbot @GoVulnBot