Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2024-45807 #3146

Closed
GoVulnBot opened this issue Sep 20, 2024 · 1 comment
Closed

x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2024-45807 #3146

GoVulnBot opened this issue Sep 20, 2024 · 1 comment
Assignees
@zpavlinovic
Labels
excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. triaged

Comments

@GoVulnBot
Copy link

Advisory CVE-2024-45807 references a vulnerability in the following Go modules:

Module
github.com/envoyproxy/envoy

Description:
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using oghttp as the default HTTP/2 codec, and there are potential bugs around stream management in the codec. To resolve this Envoy will switch off the oghttp2 by default. The impact of this issue is that envoy will crash. This issue has been addressed in release version 1.31.2. All users are advised to upgrade. There are no known workarounds for this issue.

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/envoyproxy/envoy
      vulnerable_at: 1.31.2
summary: CVE-2024-45807 in github.com/envoyproxy/envoy
cves:
    - CVE-2024-45807
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-45807
    - web: https://github.com/envoyproxy/envoy/security/advisories/GHSA-qc52-r4x5-9w37
source:
    id: CVE-2024-45807
    created: 2024-09-20T01:01:20.876992504Z
review_status: UNREVIEWED
@zpavlinovic zpavlinovic added possibly not Go triaged excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. labels Sep 20, 2024
@zpavlinovic zpavlinovic self-assigned this Sep 20, 2024
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/614715 mentions this issue: data/excluded: add 6 reports

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@zpavlinovic zpavlinovic

Labels
excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@zpavlinovic @gopherbot @GoVulnBot